graphql-python / graphql-python/graphql-core

construction fails for depth around > 200 / resource exhaustion?

Open
#216 11 comments 0 reactions 0 assignees View on GitHub
Dominant language
Python
Stars
531
Forks
146
PR merge metrics
No merged PRs in 30d

Description

# Reporting issues with GraphQL-core 3
In my tests the construction of a deep request tree fails with recursion problems.
The problem is a recursive approach in the generation of the graphql request tree (this is why I created the test).

Next to denial of service it is most probably possible to cause resource exhaustion attacks by passing big graphs.

There should be two changes:

- a "stack free" (not really stack free but the recursion depth is drastically reduced) approach in generating the input graph. I did something with generators in my project: graphene-protector:
https://github.com/devkral/graphene-protector
- a node limit after which the generation of the input graph is stopped with an error

I am not sure if the cost spec ( https://ibm.github.io/graphql-specs/cost-spec.html ) can fix this. The changes must take place while generating the requested input graph

Contributor guide

No contributing guide indexed for this repository

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.