-
-
Notifications
You must be signed in to change notification settings - Fork 468
Proper way to address directive overloading vulnerability #2620
Hi, I just wanted to know what's the proper way to address directive overloading vulnerabilities for lighthouse graphql servers. It seems the Query complexity limit and query depth limit is not sufficient to address this issue.
Ty
All reactions
Replies: 2 comments 1 reply
Can you explain this a bit more?
It seems the Query complexity limit and query depth limit is not sufficient to address this issue.
Why is complexity and query depth limiting not sufficient?
All reactions
Directive overloading does not count against the query complexity no matter how low you set the limit. I tried putting the query complexity limit to 10 and tried directive overloading with 500 directives and its not triggering the query complexity limit error.
image
All reactions
That is expected, because that is not what query complexity analysis does. Given you set reasonable limits on the maximum request body size and limit the amount of memory and execution time per PHP request, I don't see how this can be considered a vulnerability.