graphql-query-complexity
graphql-query-complexity copied to clipboard
Include meta fields (__typename, __type, __schema) against total field complexity
What
Update QueryComplexity.ts to count meta fields against total complexity. The current implementation only considers fields included in the schema, which omits: __typename, __type and __schema.
Why
Denial of service attacks are possible by creating many aliases of meta fields:
query LargeQuery {
__typename
alias1: __typename
alias2: __typename
...
alias1000: __typename
}
Considerations
If counting each field as 1 cost, common introspection queries will have a cost around 180. Consumers of the library may need to increase the maximum.
@jvanst Good catch! Thanks for the PR. Would you mind adding some tests for this?
@ivome @jvanst very important changes, any news on this pr?
Obsolete with #92 merged