ChilliCream / graphql-platform

Welcome to the home of the Hot Chocolate GraphQL server for .NET, the Strawberry Shake GraphQL client for .NET and Banana Cake Pop the awesome Monaco based GraphQL IDE.
https://chillicream.com
MIT License
5.25k stars 745 forks source link

AddMaxExecutionDepthRule doesn't work properly when used after AddMaxComplexityRule #3840

Closed vkynchev closed 3 years ago

vkynchev commented 3 years ago

Describe the bug AddMaxExecutionDepthRule doesn't calculate depth, but uses complexity, if it's added to the service collection after AddMaxComplexityRule.

To Reproduce Steps to reproduce the behavior:

  1. Use the following configuration in ConfigureServices
    services.AddGraphQLServer()
    ...
    .AddMaxComplexityRule(20)
    .AddMaxExecutionDepthRule(5);
  2. Send a query on a single depth level, but with complexity higher than 5 Example:
    query {
    user {
    id
    firstName
    email
    createdAt
    updatedAt
    }
    }
  3. Received this response
    {
    "errors": [
    {
      "message": "The GraphQL document has an execution depth of 6 which exceeds the max allowed execution depth of 5.",
      "locations": [
        {
          "line": 1,
          "column": 1
        }
      ],
      "extensions": {
        "allowedExecutionDepth": 5,
        "detectedExecutionDepth": 6
      }
    }
    ]
    }

Expected behavior When I swapped the position of AddMaxExecutionDepthRule and AddMaxComplexityRule the issue was solved. If that's expected to happen, I think it'll be best to update the documentation (searched the whole documentation for both v10 and v11 and found nothing about this).

Fixed code example:

services.AddGraphQLServer()
  ...
  .AddMaxExecutionDepthRule(5)
  .AddMaxComplexityRule(20);

Desktop (please complete the following information):

Additional context .NET SDK (5.0.301) HotChocolate.AspNetCore: 11.3.0 HotChocolate.AspNetCore.Authorization: 11.3.0 HotChocolate.Data.EntityFramework: 11.3.0 HotChocolate.Subscriptions.Redis: 11.3.0 HotChocolate.Types.Scalars: 11.3.0

michaelstaib commented 3 years ago

We have reworked both for V12

https://develop.chillicream.com/docs/hotchocolate/security/operation-complexity/

A preview is already available.