graphql-query-complexity
graphql-query-complexity copied to clipboard
Include meta fields (__typename, __type, __schema) against total field complexity
What
Update QueryComplexity.ts
to count meta fields against total complexity. The current implementation only considers fields included in the schema, which omits: __typename
, __type
and __schema
.
Why
Denial of service attacks are possible by creating many aliases of meta fields:
query LargeQuery {
__typename
alias1: __typename
alias2: __typename
...
alias1000: __typename
}
Considerations
If counting each field as 1
cost, common introspection queries will have a cost around 180
. Consumers of the library may need to increase the maximum.
@jvanst Good catch! Thanks for the PR. Would you mind adding some tests for this?
@ivome @jvanst very important changes, any news on this pr?
Obsolete with #92 merged