graphql-go / graphql-go/graphql

Disabling Field Suggestions

Open
#686 0 comments 0 reactions 0 assignees View on GitHub
Dominant language
Go
Stars
10.1k
Forks
845
PR merge metrics
No merged PRs in 30d

Description

Hello,

We would like to be able to disable field suggestions per this type of vulnerability https://www.acunetix.com/vulnerabilities/web/graphql-field-suggestions-enabled/#:~:text=GraphQL%20Field%20Suggestions%20is%20a,navigate%20the%20API%20more%20effectively.

Looks to me that it is done here https://github.com/graphql-go/graphql/blob/4ebf270b92df8ca6b2eb2ed97e595e642dee9b0a/rules.go#L193

Is there currently a way to disable suggestedFields which im not seeing?

If not, would you accept a PR which toggles this? If so would you give me some rough idea on what would be good way to do this? I do not see any kind of configuration option in ValidationContext

It would be very cool if we could do this and also configure disabling introspection in a cleaner way than what we must do here https://github.com/graphql-go/graphql/issues/649

Its worth pointing out that security vendors bring these two up all the with graphql so this will become even more desired as the library grows in popularity.

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.