graphql-python / graphql-python/graphql-core
construction fails for depth around > 200 / resource exhaustion?
- Ngôn ngữ chính
- Python
- Star
- 531
- Fork
- 146
- Chỉ số merge pull request
- Không có pull request nào được merge trong 30 ngày
Mô tả
# Reporting issues with GraphQL-core 3
In my tests the construction of a deep request tree fails with recursion problems.
The problem is a recursive approach in the generation of the graphql request tree (this is why I created the test).
Next to denial of service it is most probably possible to cause resource exhaustion attacks by passing big graphs.
There should be two changes:
- a "stack free" (not really stack free but the recursion depth is drastically reduced) approach in generating the input graph. I did something with generators in my project: graphene-protector:
https://github.com/devkral/graphene-protector
- a node limit after which the generation of the input graph is stopped with an error
I am not sure if the cost spec ( https://ibm.github.io/graphql-specs/cost-spec.html ) can fix this. The changes must take place while generating the requested input graph
Hướng dẫn đóng góp
Chưa lập chỉ mục được hướng dẫn đóng góp cho kho mã nguồn này
Đánh giá
Issue này chưa được đánh giá.