Add max_depth limit to GraphQL queries once again
We accidentally removed this code in commit c984e666f. As mentioned in
our GraphQL documentation, limiting the depth of the queries helps
against DoS attacks.
This commit is contained in:
@@ -1,4 +1,6 @@
|
||||
class ConsulSchema < GraphQL::Schema
|
||||
mutation(Types::MutationType)
|
||||
query(Types::QueryType)
|
||||
|
||||
max_depth 8
|
||||
end
|
||||
|
||||
37
spec/graphql/consul_schema_spec.rb
Normal file
37
spec/graphql/consul_schema_spec.rb
Normal file
@@ -0,0 +1,37 @@
|
||||
require "rails_helper"
|
||||
|
||||
describe ConsulSchema do
|
||||
let(:user) { create(:user) }
|
||||
|
||||
it "returns an error for queries exceeding max depth" do
|
||||
query = <<~GRAPHQL
|
||||
{
|
||||
user(id: #{user.id}) {
|
||||
public_proposals {
|
||||
edges {
|
||||
node {
|
||||
public_author {
|
||||
username
|
||||
public_proposals {
|
||||
edges {
|
||||
node {
|
||||
public_author {
|
||||
username
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
GRAPHQL
|
||||
|
||||
response = execute(query)
|
||||
|
||||
expect(response["errors"]).not_to be nil
|
||||
expect(response["errors"].first["message"]).to match(/exceeds max depth/)
|
||||
end
|
||||
end
|
||||
Reference in New Issue
Block a user