Add max_depth limit to GraphQL queries once again

We accidentally removed this code in commit c984e666f. As mentioned in
our GraphQL documentation, limiting the depth of the queries helps
against DoS attacks.
This commit is contained in:
Javi Martín
2024-09-25 14:21:06 +02:00
parent d28854802e
commit 90bb7484a5
2 changed files with 39 additions and 0 deletions

View File

@@ -1,4 +1,6 @@
class ConsulSchema < GraphQL::Schema class ConsulSchema < GraphQL::Schema
mutation(Types::MutationType) mutation(Types::MutationType)
query(Types::QueryType) query(Types::QueryType)
max_depth 8
end end

View File

@@ -0,0 +1,37 @@
require "rails_helper"
describe ConsulSchema do
let(:user) { create(:user) }
it "returns an error for queries exceeding max depth" do
query = <<~GRAPHQL
{
user(id: #{user.id}) {
public_proposals {
edges {
node {
public_author {
username
public_proposals {
edges {
node {
public_author {
username
}
}
}
}
}
}
}
}
}
}
GRAPHQL
response = execute(query)
expect(response["errors"]).not_to be nil
expect(response["errors"].first["message"]).to match(/exceeds max depth/)
end
end