Skip to content

Conversation

steven-sheehy
Copy link
Contributor

Description:

  • Add GraphQL query complexity and depth instrumentation
  • Configure GraphQL parsing limits
  • Configure Jackson parsing limits
  • Configure Tomcat request body limits
  • Disable GraphiQL by default for improved security

Related issue(s):

Notes for reviewer:

Checklist

  • Documented (Code comments, README, etc.)
  • Tested (unit, integration, etc.)

@steven-sheehy steven-sheehy added bug Type: Something isn't working security graphql Area: GraphQL labels Feb 13, 2025
@steven-sheehy steven-sheehy added this to the 0.124.0 milestone Feb 13, 2025
@steven-sheehy steven-sheehy self-assigned this Feb 13, 2025
@steven-sheehy steven-sheehy requested a review from a team as a code owner February 13, 2025 19:25
Signed-off-by: Steven Sheehy <[email protected]>
Copy link

Copy link

codecov bot commented Feb 13, 2025

Codecov Report

Attention: Patch coverage is 96.42857% with 1 line in your changes missing coverage. Please review.

Project coverage is 92.20%. Comparing base (154e20f) to head (eff4fc2).
Report is 2 commits behind head on main.

Files with missing lines Patch % Lines
...mirror/graphql/config/CustomExceptionResolver.java 0.00% 0 Missing and 1 partial ⚠️
Additional details and impacted files
@@             Coverage Diff              @@
##               main   #10379      +/-   ##
============================================
+ Coverage     92.18%   92.20%   +0.02%     
- Complexity     8095     8103       +8     
============================================
  Files           988      988              
  Lines         33713    33739      +26     
  Branches       4263     4263              
============================================
+ Hits          31077    31109      +32     
+ Misses         1620     1617       -3     
+ Partials       1016     1013       -3     

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

Copy link
Contributor

@edwin-greene edwin-greene left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Looks good to me

Copy link
Contributor

@jnels124 jnels124 left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTM

@steven-sheehy steven-sheehy merged commit d7a7997 into main Feb 13, 2025
36 checks passed
@steven-sheehy steven-sheehy deleted the graphql-limits branch February 13, 2025 23:33
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
bug Type: Something isn't working graphql Area: GraphQL security
Projects
None yet
Development

Successfully merging this pull request may close these issues.

3 participants