graphql-python / graphql-python/graphql-core

construction fails for depth around > 200 / resource exhaustion?

Ouverte
#216 11 commentaires 0 réactions 0 personnes assignées Voir sur GitHub
Langage dominant
Python
Étoiles
531
Forks
146
Métriques de merge des PR
Aucune PR mergée en 30 j

Description

# Reporting issues with GraphQL-core 3
In my tests the construction of a deep request tree fails with recursion problems.
The problem is a recursive approach in the generation of the graphql request tree (this is why I created the test).

Next to denial of service it is most probably possible to cause resource exhaustion attacks by passing big graphs.

There should be two changes:

- a "stack free" (not really stack free but the recursion depth is drastically reduced) approach in generating the input graph. I did something with generators in my project: graphene-protector:
https://github.com/devkral/graphene-protector
- a node limit after which the generation of the input graph is stopped with an error

I am not sure if the cost spec ( https://ibm.github.io/graphql-specs/cost-spec.html ) can fix this. The changes must take place while generating the requested input graph

Guide de contribution

Aucun guide de contribution indexé pour ce dépôt

Évaluation

Cette issue n'a pas encore été évaluée.

Recevez les nouvelles issues par e-mail

Un résumé court des issues GitHub adaptées aux débutants.