construction fails for depth around > 200 / resource exhaustion?
Nobody has claimed this yet.
Assessment
- Difficulty
- 5/5
- Estimated time
- Over a week
- Newbie friendliness
- 35/100
Research direction
Start by locating the recursive generation of the GraphQL request/input tree and the test for deep request construction mentioned in the issue. Reproduce the recursion failure with a depth above 200, then evaluate an iterative or generator-based approach and a node limit. Done means deep or oversized graphs fail safely with a clear error rather than exhausting resources.
Written by the indexing model from the issue text.
Description
Reporting issues with GraphQL-core 3
In my tests the construction of a deep request tree fails with recursion problems.
The problem is a recursive approach in the generation of the graphql request tree (this is why I created the test).
Next to denial of service it is most probably possible to cause resource exhaustion attacks by passing big graphs.
There should be two changes:
- a "stack free" (not really stack free but the recursion depth is drastically reduced) approach in generating the input graph. I did something with generators in my project: graphene-protector:
https://github.com/devkral/graphene-protector - a node limit after which the generation of the input graph is stopped with an error
I am not sure if the cost spec ( https://ibm.github.io/graphql-specs/cost-spec.html ) can fix this. The changes must take place while generating the requested input graph
- Dominant language
- Python
- Stars
- 531
- Forks
- 147
- PR merge metrics
- No merged PRs in 30d
Contributor guide
No contributing guide indexed for this repository
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
More from graphql-python/graphql-core
-
Difficulty 4/5 3-5 days Newbie friendliness 50/100
graphql-python/graphql-core#272 · 1 comment ·
-
Difficulty 3/5 1-2 days Newbie friendliness 55/100
graphql-python/graphql-core#269 · 1 comment ·
-
Difficulty 5/5 Over a week Newbie friendliness 35/100
graphql-python/graphql-core#267 · 1 comment ·
-
Difficulty 3/5 1-2 days Newbie friendliness 45/100
graphql-python/graphql-core#257 ·
-
Difficulty 5/5 Over a week Newbie friendliness 25/100
graphql-python/graphql-core#247 · 8 comments ·
All issues in graphql-python/graphql-core
Similar issues
-
essnmx good first issue
Difficulty 1/5 Under an hour Newbie friendliness 95/100
-
[Feature] 奇物选择添加优先级 Open
Difficulty 2/5 1-3 hours Newbie friendliness 65/100
syfoud/Simulated_Scepter#174 ·
-
Difficulty 2/5 1-3 hours Newbie friendliness 75/100
Giskard-AI/giskard-oss#2840 · 1 comment ·
-
A claim comment carrying the issue number is silently declined while the workflow reports success Openarea: repo bug perceived difficulty: 2
Difficulty 2/5 1-3 hours Newbie friendliness 70/100
-
Difficulty 2/5 1-3 hours Newbie friendliness 75/100
yeti-platform/yeti#1380 ·