graphql-go / graphql

An implementation of GraphQL for Go / Golang
MIT License
9.82k stars 836 forks source link

Disabling Field Suggestions #686

Open hoffoo opened 6 months ago

hoffoo commented 6 months ago

Hello,

We would like to be able to disable field suggestions per this type of vulnerability https://www.acunetix.com/vulnerabilities/web/graphql-field-suggestions-enabled/#:~:text=GraphQL%20Field%20Suggestions%20is%20a,navigate%20the%20API%20more%20effectively.

Looks to me that it is done here https://github.com/graphql-go/graphql/blob/4ebf270b92df8ca6b2eb2ed97e595e642dee9b0a/rules.go#L193

Is there currently a way to disable suggestedFields which im not seeing?

If not, would you accept a PR which toggles this? If so would you give me some rough idea on what would be good way to do this? I do not see any kind of configuration option in ValidationContext

It would be very cool if we could do this and also configure disabling introspection in a cleaner way than what we must do here https://github.com/graphql-go/graphql/issues/649

Its worth pointing out that security vendors bring these two up all the with graphql so this will become even more desired as the library grows in popularity.