Fix query introspection blocking on deeply nested types.

graphql.go

@@ -80,10 +80,6 @@ func parseGraphQLQuery(c *fiber.Ctx) *parseGraphQLQueryResult {
 			if ifNotInTest() {
 					cfg.Monitoring.Increment(libpack_monitoring.MetricsSkipped, nil)
 			}
-		if res.shouldBlock {
-			resultPool.Put(res)
-			return res
-		}
 			return res
 	}
 
@@ -96,7 +92,6 @@ func parseGraphQLQuery(c *fiber.Ctx) *parseGraphQLQueryResult {
 			if ifNotInTest() {
 					cfg.Monitoring.Increment(libpack_monitoring.MetricsSkipped, nil)
 			}
-		resultPool.Put(res)
 			return res
 	}
 
@@ -109,7 +104,6 @@ func parseGraphQLQuery(c *fiber.Ctx) *parseGraphQLQueryResult {
 			if ifNotInTest() {
 					cfg.Monitoring.Increment(libpack_monitoring.MetricsFailed, nil)
 			}
-		resultPool.Put(res)
 			return res
 	}
 
@@ -126,21 +120,11 @@ func parseGraphQLQuery(c *fiber.Ctx) *parseGraphQLQueryResult {
 					}
 
 					if cfg.Server.HostGraphQLReadOnly != "" {
-				if res.operationType == "" {
-					res.activeEndpoint = cfg.Server.HostGraphQLReadOnly
-				} else if res.operationType != "mutation" {
+							if res.operationType == "" || res.operationType != "mutation" {
 									res.activeEndpoint = cfg.Server.HostGraphQLReadOnly
 							}
 					}
 
-			cfg.Logger.Debug(&libpack_logger.LogMessage{
-				Message: "Endpoint selection",
-				Pairs: map[string]interface{}{
-					"operationType":    res.operationType,
-					"selectedEndpoint": res.activeEndpoint,
-				},
-			})
-
 					if res.operationType == "mutation" && cfg.Server.ReadOnlyMode {
 							cfg.Logger.Warning(&libpack_logger.LogMessage{
 									Message: "Mutation blocked - server in read-only mode",
@@ -174,8 +158,9 @@ func parseGraphQLQuery(c *fiber.Ctx) *parseGraphQLQueryResult {
 					}
 
 					if cfg.Security.BlockIntrospection {
-				res.shouldBlock = checkSelections(c, oper.GetSelectionSet().Selections)
-				if res.shouldBlock {
+							if checkSelections(c, oper.GetSelectionSet().Selections) {
+									_ = c.Status(403).SendString("Introspection queries are not allowed")
+									res.shouldBlock = true
 									resultPool.Put(res)
 									return res
 							}
@@ -186,43 +171,61 @@ func parseGraphQLQuery(c *fiber.Ctx) *parseGraphQLQueryResult {
 }
 
 func checkSelections(c *fiber.Ctx, selections []ast.Selection) bool {
-	stack := make([]ast.Selection, len(selections))
-	copy(stack, selections)
-
-	for len(stack) > 0 {
-		var s ast.Selection
-		s, stack = stack[len(stack)-1], stack[:len(stack)-1]
-
-		if field, ok := s.(*ast.Field); ok {
-			if checkIfContainsIntrospection(c, field.Name.Value) {
+	for _, s := range selections {
+			switch sel := s.(type) {
+			case *ast.Field:
+					fieldName := strings.ToLower(sel.Name.Value)
+					if _, exists := introspectionQueries[fieldName]; exists {
+							if len(cfg.Security.IntrospectionAllowed) > 0 {
+									if _, allowed := introspectionAllowedQueries[fieldName]; !allowed {
+											return true
+									}
+							} else {
+									return true
+							}
+					}
+					if sel.SelectionSet != nil {
+							if checkSelections(c, sel.GetSelectionSet().Selections) {
 									return true
 							}
-			if field.SelectionSet != nil {
-				stack = append(stack, field.GetSelectionSet().Selections...)
 					}
 			}
 	}
 	return false
 }
 
-func checkIfContainsIntrospection(c *fiber.Ctx, whatever string) bool {
-	whateverLower := strings.ToLower(whatever)
-
+func checkIfContainsIntrospection(c *fiber.Ctx, query string) bool {
+	blocked := false
+	// Try parsing as a complete query first
+	p, err := parser.Parse(parser.ParseParams{Source: query})
+	if err == nil {
+		// It's a complete query, check all selections
+		for _, def := range p.Definitions {
+			if op, ok := def.(*ast.OperationDefinition); ok {
+				if op.SelectionSet != nil {
+					blocked = checkSelections(c, op.GetSelectionSet().Selections)
+				}
+			}
+		}
+	} else {
+		// Not a complete query, check as a field name
+		whateverLower := strings.ToLower(query)
 		if _, exists := introspectionQueries[whateverLower]; exists {
 			if len(cfg.Security.IntrospectionAllowed) > 0 {
-			if _, allowed := introspectionAllowedQueries[whateverLower]; allowed {
-				cfg.Logger.Debug(&libpack_logger.LogMessage{
-					Message: "Introspection query allowed, passing through",
-					Pairs:   map[string]interface{}{"query": whatever},
-				})
-				return false
+				if _, allowed := introspectionAllowedQueries[whateverLower]; !allowed {
+					blocked = true
+				}
+			} else {
+				blocked = true
 			}
 		}
+	}
+
+	if blocked {
 		if ifNotInTest() {
 			cfg.Monitoring.Increment(libpack_monitoring.MetricsSkipped, nil)
 		}
 		_ = c.Status(403).SendString("Introspection queries are not allowed")
-		return true
 	}
-	return false
+	return blocked
 }

graphql_test.go

@@ -408,6 +408,8 @@ func (suite *Tests) Test_checkIfContainsIntrospection() {
 		{"allowed introspection", "__schema", []string{"__schema"}, false},
 		{"disallowed introspection", "__type", []string{"__schema"}, true},
 		{"non-introspection query", "normalQuery", []string{}, false},
+		{"allowed introspection with deep nesting of __typename", "{__schema {queryType {fields {name description __typename}}}}", []string{"__schema", "__typename"}, false},
+		{"disallowed introspection with deep nesting of __typename", "{__type {queryType {fields {name description __typename}}}}", []string{"__type"}, true},
 	}
 
 	for _, tt := range tests {