Commit f80f68d5 authored by Ken Ding's avatar Ken Ding

58404 - setup max depth for graphql


58404 - add change log


58404 - add spec


58404 - add more spec to test depth 2


58404 - fix spec


58404 - fix rubocop


58404 - refactor the code by Bob's advice


58404 - revert changes of all_graphql_fields_for


58404 - change text only


58404 - fix rspec according to gitlab's standard


58404 - revert previous spec


58404 - fix rubocop
parent 4ebbfb9f
...@@ -7,6 +7,9 @@ class GitlabSchema < GraphQL::Schema ...@@ -7,6 +7,9 @@ class GitlabSchema < GraphQL::Schema
AUTHENTICATED_COMPLEXITY = 250 AUTHENTICATED_COMPLEXITY = 250
ADMIN_COMPLEXITY = 300 ADMIN_COMPLEXITY = 300
ANONYMOUS_MAX_DEPTH = 10
AUTHENTICATED_MAX_DEPTH = 15
use BatchLoader::GraphQL use BatchLoader::GraphQL
use Gitlab::Graphql::Authorize use Gitlab::Graphql::Authorize
use Gitlab::Graphql::Present use Gitlab::Graphql::Present
...@@ -23,21 +26,36 @@ class GitlabSchema < GraphQL::Schema ...@@ -23,21 +26,36 @@ class GitlabSchema < GraphQL::Schema
mutation(Types::MutationType) mutation(Types::MutationType)
def self.execute(query_str = nil, **kwargs) class << self
kwargs[:max_complexity] ||= max_query_complexity(kwargs[:context]) def execute(query_str = nil, **kwargs)
kwargs[:max_complexity] ||= max_query_complexity(kwargs[:context])
kwargs[:max_depth] ||= max_query_depth(kwargs[:context])
super(query_str, **kwargs) super(query_str, **kwargs)
end end
private
def max_query_complexity(ctx)
current_user = ctx&.fetch(:current_user, nil)
if current_user&.admin
ADMIN_COMPLEXITY
elsif current_user
AUTHENTICATED_COMPLEXITY
else
DEFAULT_MAX_COMPLEXITY
end
end
def self.max_query_complexity(ctx) def max_query_depth(ctx)
current_user = ctx&.fetch(:current_user, nil) current_user = ctx&.fetch(:current_user, nil)
if current_user&.admin if current_user
ADMIN_COMPLEXITY AUTHENTICATED_MAX_DEPTH
elsif current_user else
AUTHENTICATED_COMPLEXITY ANONYMOUS_MAX_DEPTH
else end
DEFAULT_MAX_COMPLEXITY
end end
end end
end end
---
title: 58404 - setup max depth for GraphQL
merge_request: 25737
author: Ken Ding
type: added
...@@ -3,6 +3,8 @@ ...@@ -3,6 +3,8 @@
require 'spec_helper' require 'spec_helper'
describe GitlabSchema do describe GitlabSchema do
let(:user) { build :user }
it 'uses batch loading' do it 'uses batch loading' do
expect(field_instrumenters).to include(BatchLoader::GraphQL) expect(field_instrumenters).to include(BatchLoader::GraphQL)
end end
...@@ -33,43 +35,75 @@ describe GitlabSchema do ...@@ -33,43 +35,75 @@ describe GitlabSchema do
expect(connection).to eq(Gitlab::Graphql::Connections::KeysetConnection) expect(connection).to eq(Gitlab::Graphql::Connections::KeysetConnection)
end end
context 'for different types of users' do describe '.execute' do
it 'returns DEFAULT_MAX_COMPLEXITY for no context' do context 'for different types of users' do
expect(GraphQL::Schema) context 'when no context' do
.to receive(:execute) it 'returns DEFAULT_MAX_COMPLEXITY' do
.with('query', hash_including(max_complexity: GitlabSchema::DEFAULT_MAX_COMPLEXITY)) expect(GraphQL::Schema)
.to receive(:execute)
.with('query', hash_including(max_complexity: GitlabSchema::DEFAULT_MAX_COMPLEXITY))
described_class.execute('query') described_class.execute('query')
end end
end
it 'returns DEFAULT_MAX_COMPLEXITY for no user' do context 'when no user' do
expect(GraphQL::Schema) it 'returns DEFAULT_MAX_COMPLEXITY' do
.to receive(:execute) expect(GraphQL::Schema)
.with('query', hash_including(max_complexity: GitlabSchema::DEFAULT_MAX_COMPLEXITY)) .to receive(:execute)
.with('query', hash_including(max_complexity: GitlabSchema::DEFAULT_MAX_COMPLEXITY))
described_class.execute('query', context: {}) described_class.execute('query', context: {})
end end
it 'returns AUTHENTICATED_COMPLEXITY for a logged in user' do it 'returns ANONYMOUS_MAX_DEPTH' do
user = build :user expect(GraphQL::Schema)
.to receive(:execute)
.with('query', hash_including(max_depth: GitlabSchema::ANONYMOUS_MAX_DEPTH))
expect(GraphQL::Schema).to receive(:execute).with('query', hash_including(max_complexity: GitlabSchema::AUTHENTICATED_COMPLEXITY)) described_class.execute('query', context: {})
end
end
described_class.execute('query', context: { current_user: user }) context 'when a logged in user' do
end it 'returns AUTHENTICATED_COMPLEXITY' do
expect(GraphQL::Schema).to receive(:execute).with('query', hash_including(max_complexity: GitlabSchema::AUTHENTICATED_COMPLEXITY))
it 'returns ADMIN_COMPLEXITY for an admin user' do described_class.execute('query', context: { current_user: user })
user = build :user, :admin end
expect(GraphQL::Schema).to receive(:execute).with('query', hash_including(max_complexity: GitlabSchema::ADMIN_COMPLEXITY)) it 'returns AUTHENTICATED_MAX_DEPTH' do
expect(GraphQL::Schema).to receive(:execute).with('query', hash_including(max_depth: GitlabSchema::AUTHENTICATED_MAX_DEPTH))
described_class.execute('query', context: { current_user: user }) described_class.execute('query', context: { current_user: user })
end end
end
context 'when an admin user' do
it 'returns ADMIN_COMPLEXITY' do
user = build :user, :admin
expect(GraphQL::Schema).to receive(:execute).with('query', hash_including(max_complexity: GitlabSchema::ADMIN_COMPLEXITY))
described_class.execute('query', context: { current_user: user })
end
end
context 'when max_complexity passed on the query' do
it 'returns what was passed on the query' do
expect(GraphQL::Schema).to receive(:execute).with('query', hash_including(max_complexity: 1234))
described_class.execute('query', max_complexity: 1234)
end
end
it 'returns what was passed on the query' do context 'when max_depth passed on the query' do
expect(GraphQL::Schema).to receive(:execute).with('query', { max_complexity: 1234 }) it 'returns what was passed on the query' do
expect(GraphQL::Schema).to receive(:execute).with('query', hash_including(max_depth: 1234))
described_class.execute('query', max_complexity: 1234) described_class.execute('query', max_depth: 1234)
end
end
end end
end end
......
...@@ -3,15 +3,43 @@ require 'spec_helper' ...@@ -3,15 +3,43 @@ require 'spec_helper'
describe 'GitlabSchema configurations' do describe 'GitlabSchema configurations' do
include GraphqlHelpers include GraphqlHelpers
it 'shows an error if complexity is too high' do let(:project) { create(:project, :repository) }
project = create(:project, :repository) let(:query) { graphql_query_for('project', { 'fullPath' => project.full_path }, %w(id name description)) }
query = graphql_query_for('project', { 'fullPath' => project.full_path }, %w(id name description)) let(:current_user) { create(:user) }
allow(GitlabSchema).to receive(:max_query_complexity).and_return 1 describe '#max_complexity' do
context 'when complexity is too high' do
it 'shows an error' do
allow(GitlabSchema).to receive(:max_query_complexity).and_return 1
post_graphql(query, current_user: nil) post_graphql(query, current_user: nil)
expect(graphql_errors.first['message']).to include('which exceeds max complexity of 1') expect(graphql_errors.first['message']).to include('which exceeds max complexity of 1')
end
end
end
describe '#max_depth' do
context 'when query depth is too high' do
it 'shows error' do
errors = [{ "message" => "Query has depth of 2, which exceeds max depth of 1" }]
allow(GitlabSchema).to receive(:max_query_depth).and_return 1
post_graphql(query)
expect(graphql_errors).to eq(errors)
end
end
context 'when query depth is within range' do
it 'has no error' do
allow(GitlabSchema).to receive(:max_query_depth).and_return 5
post_graphql(query)
expect(graphql_errors).to be_nil
end
end
end end
context 'when IntrospectionQuery' do context 'when IntrospectionQuery' do
......
...@@ -102,6 +102,7 @@ module GraphqlHelpers ...@@ -102,6 +102,7 @@ module GraphqlHelpers
def all_graphql_fields_for(class_name, parent_types = Set.new) def all_graphql_fields_for(class_name, parent_types = Set.new)
allow_unlimited_graphql_complexity allow_unlimited_graphql_complexity
allow_unlimited_graphql_depth
type = GitlabSchema.types[class_name.to_s] type = GitlabSchema.types[class_name.to_s]
return "" unless type return "" unless type
...@@ -190,4 +191,9 @@ module GraphqlHelpers ...@@ -190,4 +191,9 @@ module GraphqlHelpers
allow_any_instance_of(GitlabSchema).to receive(:max_complexity).and_return nil allow_any_instance_of(GitlabSchema).to receive(:max_complexity).and_return nil
allow(GitlabSchema).to receive(:max_query_complexity).with(any_args).and_return nil allow(GitlabSchema).to receive(:max_query_complexity).with(any_args).and_return nil
end end
def allow_unlimited_graphql_depth
allow_any_instance_of(GitlabSchema).to receive(:max_depth).and_return nil
allow(GitlabSchema).to receive(:max_query_depth).with(any_args).and_return nil
end
end end
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment