graphql-go / graphql-go/graphql

Disable graphql suggestions

Open
#749 0 comments 0 reactions 0 assignees View on GitHub
Dominant language
Go
Stars
10.1k
Forks
845
PR merge metrics
No merged PRs in 30d

Description

Hi,

Due to the security concerns of graphql suggestions we would like a configuration to disable it. I noticed there was an issue for the same created two years ago, but it has not received any replies from community: [686](https://github.com/graphql-go/graphql/issues/686).

Is there any plans to make this an opt out feature by adding a DisableSuggestions option in SchemaConfig? If set to "true", the suggestions do not get created.

As the code currently handles empty suggestions gracefully, is it possible to handle the logic with returning an empty suggestionList (example from suggestionList() in graphql/rules.go):
```go
func suggestionList(schema *Schema, input string, options []string) []string {
if schema != nil && schema.DisableSuggestions() {
return nil
}
.....
```

This check would also have to be there for getSuggestedFieldNames and getSuggestedTypeNames.

This behaviour is already supported (example):
```go
func unknownTypeMessage(typeName string, suggestedTypes []string) string {
message := fmt.Sprintf(`Unknown type "%v".`, typeName)
if len(suggestedTypes) > 0 {
message = fmt.Sprintf(`%v Did you mean %v?`, message, quotedOrList(suggestedTypes))
}

return message
}
```

This is an item that is often raised by security vendors when using graphql. I am reraising this issue as the old one seems forgotten/not triaged.

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.