Closed lee-pai-long closed 9 months ago
Is this something that could be solved with a custom ValidationRule
? You might want to take a look at #1475.
Hi @kiendang the instrospection can be solve with that yes, but not the rest.
I think a few of these, Alias Overloading, Directive Overloading and Field Duplication could be solved by writing a custom ValidationRule
that analyses the query.
The CSRF issues could be solved by configuring Django if I'm not wrong.
@kiendang but how to limit the number of aliases, directives and field in a custom validation rule ?
I guess you could traverse the AST and count the number of occurrences? See Implementing a custom ValudationRule
and the Visitor
class.
Anw I'm converting this to a discussion which I think is more appropriate.
Is your feature request related to a problem? Please describe. I used graphql-cop to test my graphql API built using Graphene Django and the result is as follows:
I would like to have options for example to disable or limit use of aliases to prevent Alias Overloading but I can't find options to mitigate this or the other attacks.
Describe the solution you'd like Is it possible to provide options to mitigate those attacks in a futur version of graphene-django ?
Describe alternatives you've considered ...
Additional context ...