diff --git a/README.md b/README.md index 88dd2cb..b982e9d 100644 --- a/README.md +++ b/README.md @@ -40,7 +40,7 @@ I wanted to monitor the queries and responses of our graphql endpoint. Still, we You should always try to stick to the latest and greatest version of the graphql-proxy to ensure that it's as much bug-free as possible. Following list will be kept to the maximum of five "most important" bugs and enhancements included in the latest versions. -* **06/12/2024 - 0.24.1** - Fixes the bug where deeply nested introspection queries were blocked despite of being present on the whitelist. GraphQL proxy will now inspect the queries in depth to find any possible nested introspections. +* **06/12/2024 - 0.24.2** - Fixes the bug where deeply nested introspection queries were blocked despite of being present on the whitelist. GraphQL proxy will now inspect the queries in depth to find any possible nested introspections. * **20/08/2024 - 0.23.21+** - Fixes the bug when timeouts were not respected on proxy-graphql line. Affected versions before that were timeouting after 30 seconds which was set as default ( thanks to Jurica Železnjak for reporting ). It also provides a temporary fix for running within kubernetes deployment, when graphql server ( for example - hasura ) took more time to start than the proxy, causing avalanche of errors with "can't proxy the request". diff --git a/graphql.go b/graphql.go index b2a852c..8a8396a 100644 --- a/graphql.go +++ b/graphql.go @@ -28,11 +28,11 @@ var ( func prepareQueriesAndExemptions() { for _, q := range cfg.Security.IntrospectionAllowed { - introspectionAllowedQueries[strings.ToLower(q)] = struct{}{} + introspectionAllowedQueries[strings.ToLower(q)] = struct{}{} } for _, u := range cfg.Server.AllowURLs { - allowedUrls[u] = struct{}{} + allowedUrls[u] = struct{}{} } } @@ -184,7 +184,6 @@ func checkSelections(c *fiber.Ctx, selections []ast.Selection) bool { return true } } - // Check nested selections even if current field is allowed if sel.SelectionSet != nil { if checkSelections(c, sel.GetSelectionSet().Selections) { return true @@ -196,8 +195,6 @@ func checkSelections(c *fiber.Ctx, selections []ast.Selection) bool { return true } } - case *ast.FragmentSpread: - // If we need to handle fragment spreads, additional logic would go here } } return false diff --git a/graphql_test.go b/graphql_test.go index 335a531..f41a3ea 100644 --- a/graphql_test.go +++ b/graphql_test.go @@ -465,6 +465,18 @@ func (suite *Tests) Test_DeepIntrospectionQueries() { allowed: []string{"__typename", "__schema", "__type"}, expected: false, }, + { + name: "deeply nested with repeated item from allowlist", + query: "query PreloadStaticData {\n scenario {\n id\n name\n __typename\n }\n impact {\n id\n description\n __typename\n }\n likelihood {\n id\n description\n __typename\n }\n consequence {\n name\n __typename\n }\n risk_categories {\n name\n abbreviation\n __typename\n }\n mitigation {\n name\n __typename\n }\n}", + allowed: []string{"__type", "__typename"}, + expected: false, + }, + { + name: "deeply nested with repeated item denied", + query: "query PreloadStaticData {\n scenario {\n id\n name\n __typename\n }\n impact {\n id\n description\n __typename\n }\n likelihood {\n id\n description\n __typename\n }\n consequence {\n name\n __typename\n }\n risk_categories {\n name\n abbreviation\n __typename\n }\n mitigation {\n name\n __typename\n }\n}", + allowed: []string{}, + expected: true, + }, } for _, tt := range tests {