79 lines
2.4 KiB
Ruby
79 lines
2.4 KiB
Ruby
|
# frozen_string_literal: true
|
||
|
|
|
||
|
|
# Recursive queries, with relatively low effort, can quickly spiral out of control exponentially
|
||
|
|
# and may not be picked up by depth and complexity alone.
|
||
|
|
module Gitlab
|
||
|
|
module Graphql
|
||
|
|
module QueryAnalyzers
|
||
|
|
module AST
|
||
|
|
class RecursionAnalyzer < GraphQL::Analysis::AST::Analyzer
|
||
|
|
IGNORED_FIELDS = %w(node edges nodes ofType).freeze
|
||
|
|
RECURSION_THRESHOLD = 2
|
||
|
|
|
||
|
|
def initialize(query)
|
||
|
|
super
|
||
|
|
|
||
|
|
@node_visits = {}
|
||
|
|
@recurring_fields = {}
|
||
|
|
end
|
||
|
|
|
||
|
|
def on_enter_field(node, _parent, visitor)
|
||
|
|
return if skip_node?(node, visitor)
|
||
|
|
|
||
|
|
node_name = node.name
|
||
|
|
node_visits[node_name] ||= 0
|
||
|
|
node_visits[node_name] += 1
|
||
|
|
|
||
|
|
times_encountered = @node_visits[node_name]
|
||
|
|
recurring_fields[node_name] = times_encountered if recursion_too_deep?(node_name, times_encountered)
|
||
|
|
end
|
||
|
|
|
||
|
|
# Visitors are all defined on the AST::Analyzer base class
|
||
|
|
# We override them for custom analyzers.
|
||
|
|
def on_leave_field(node, _parent, visitor)
|
||
|
|
return if skip_node?(node, visitor)
|
||
|
|
|
||
|
|
node_name = node.name
|
||
|
|
node_visits[node_name] ||= 0
|
||
|
|
node_visits[node_name] -= 1
|
||
|
|
end
|
||
|
|
|
||
|
|
def result
|
||
|
|
@recurring_fields = @recurring_fields.select { |k, v| recursion_too_deep?(k, v) }
|
||
|
|
|
||
|
|
if @recurring_fields.any?
|
||
|
|
GraphQL::AnalysisError.new(<<~MSG)
|
||
|
|
Recursive query - too many of fields '#{@recurring_fields}' detected
|
||
|
|
in single branch of the query")
|
||
|
|
MSG
|
||
|
|
end
|
||
|
|
end
|
||
|
|
|
||
|
|
private
|
||
|
|
|
||
|
|
attr_reader :node_visits, :recurring_fields
|
||
|
|
|
||
|
|
def recursion_too_deep?(node_name, times_encountered)
|
||
|
|
return if IGNORED_FIELDS.include?(node_name)
|
||
|
|
|
||
|
|
times_encountered > recursion_threshold
|
||
|
|
end
|
||
|
|
|
||
|
|
def skip_node?(node, visitor)
|
||
|
|
# We don't want to count skipped fields or fields
|
||
|
|
# inside fragment definitions
|
||
|
|
return false if visitor.skipping? || visitor.visiting_fragment_definition?
|
||
|
|
|
||
|
|
!node.is_a?(GraphQL::Language::Nodes::Field) || node.selections.empty?
|
||
|
|
end
|
||
|
|
|
||
|
|
# separated into a method for use in allow_high_graphql_recursion
|
||
|
|
def recursion_threshold
|
||
|
|
RECURSION_THRESHOLD
|
||
|
|
end
|
||
|
|
end
|
||
|
|
end
|
||
|
|
end
|
||
|
|
end
|
||
|
|
end
|