graphql-python / graphql-python/graphql-core

construction fails for depth around > 200 / resource exhaustion?

未关闭
#216 11 条评论 0 个 reaction 已指派 0 人 在 GitHub 查看
主要语言
Python
星标
531
派生
146
PR 合并指标
30 天内没有已合并 PR

描述

# Reporting issues with GraphQL-core 3
In my tests the construction of a deep request tree fails with recursion problems.
The problem is a recursive approach in the generation of the graphql request tree (this is why I created the test).

Next to denial of service it is most probably possible to cause resource exhaustion attacks by passing big graphs.

There should be two changes:

- a "stack free" (not really stack free but the recursion depth is drastically reduced) approach in generating the input graph. I did something with generators in my project: graphene-protector:
https://github.com/devkral/graphene-protector
- a node limit after which the generation of the input graph is stopped with an error

I am not sure if the cost spec ( https://ibm.github.io/graphql-specs/cost-spec.html ) can fix this. The changes must take place while generating the requested input graph

贡献指南

这个仓库没有索引到贡献指南

评估

这个 Issue 还没有评估数据。

把新 issue 发到你的邮箱

精选适合新手参与的 GitHub issue 摘要。