Limit GraphQL queries complexity once again

We accidentally removed the code for maximum complexity in commit
c984e666f. As mentioned in the documentation:

> The main risk factor is multiple collections of resources being
> requested in the same query.

We reject these requests by limiting the complexity.

The `max_complexity` option depends on the page size being set. Without
it, we get an error:

```
Can't calculate complexity for User.public_debates, no `first:`,
`last:`, `max_page_size` or `default_max_page_size`
```

So we're also adding a default max page size.

Note that the documentation mentioned that the default page size was 25.
However, before commit c984e666f, we were using a page size of 50 in
some cases. We're going with the one mentioned in the documentation
since we don't fully understand the old code.
This commit is contained in:
Javi Martín
2024-09-25 14:55:12 +02:00
parent 90bb7484a5
commit 5f80a75161
2 changed files with 41 additions and 0 deletions

View File

@@ -34,4 +34,43 @@ describe ConsulSchema do
expect(response["errors"]).not_to be nil
expect(response["errors"].first["message"]).to match(/exceeds max depth/)
end
it "returns an error for queries requesting all records from more than 2 collections" do
query = <<~GRAPHQL
{
users {
edges {
node {
public_debates {
edges {
node {
title
}
}
}
public_proposals {
edges {
node {
title
}
}
}
public_comments {
edges {
node {
body
}
}
}
}
}
}
}
GRAPHQL
response = execute(query)
expect(response["errors"]).not_to be nil
expect(response["errors"].first["message"]).to match(/Query has complexity/)
end
end