graphql-go / graphql-go/graphql
Disable graphql suggestions
- Dominant language
- Go
- Stars
- 10.1k
- Forks
- 845
- PR merge metrics
- No merged PRs in 30d
Description
Hi,
Due to the security concerns of graphql suggestions we would like a configuration to disable it. I noticed there was an issue for the same created two years ago, but it has not received any replies from community: [686](https://github.com/graphql-go/graphql/issues/686).
Is there any plans to make this an opt out feature by adding a DisableSuggestions option in SchemaConfig? If set to "true", the suggestions do not get created.
As the code currently handles empty suggestions gracefully, is it possible to handle the logic with returning an empty suggestionList (example from suggestionList() in graphql/rules.go):
```go
func suggestionList(schema *Schema, input string, options []string) []string {
if schema != nil && schema.DisableSuggestions() {
return nil
}
.....
```
This check would also have to be there for getSuggestedFieldNames and getSuggestedTypeNames.
This behaviour is already supported (example):
```go
func unknownTypeMessage(typeName string, suggestedTypes []string) string {
message := fmt.Sprintf(`Unknown type "%v".`, typeName)
if len(suggestedTypes) > 0 {
message = fmt.Sprintf(`%v Did you mean %v?`, message, quotedOrList(suggestedTypes))
}
return message
}
```
This is an item that is often raised by security vendors when using graphql. I am reraising this issue as the old one seems forgotten/not triaged.
Contributor guide
Assessment
This issue has not been assessed yet.