Comments (9)
Hey there, it's best to report any particular issues with graphql-core in the corresponding repository. Please note that graphql core closely follows the reference implementation written in typescript in order to be as up to date as possible given our available maintainer time.
That's why I deem it unlikely to see any changes to the execution logic on just the python level. If you're interested in bringing this into graphql-js, it might be worthwhile to open up an RFC there and follow the process.
The limits functionality of graphene-protector look amazing. Are you interested in contributing them to strawberry-graphql or graphene directly so they're even easier to use? Feel free to contact me about both, I'm a core maintainer on both teams 😊
from graphql-core.
What Erik wrote. Completely changing the execution or parsing logic is out of the scope of this project.
If it really would be a significant improvement, consider discussing this in the upstream GraphQL-js project.
Also, please note that a max_tokens
parameter has been added to GraphQL-js and already ported to GraphQL-core. This could also help to avoid denial of service via memory exhaustion. Have you seen that?
from graphql-core.
Working example code for simply transform recursive function in an "stack free" call tree:
from functools import partial
def _foo(level=0, *, get_result):
if level > 100000:
yield level
return
print("1", level)
yield partial(_foo, level=level + 1)
print("2", get_result())
yield level
def foo():
result_stack = []
fn_stack = [_foo(get_result=result_stack.pop)]
while fn_stack:
cur_el = fn_stack[-1]
try:
next_el = next(cur_el)
if isinstance(next_el, partial):
fn_stack.append(next_el(get_result=result_stack.pop))
else:
result_stack.append(next_el)
except StopIteration:
fn_stack.pop()
foo()
from graphql-core.
thanks for the hint. Then only the first issue is valid.
It isn't really much effort. Generators are a good way to save the current progress
from graphql-core.
Hey there, it's best to report any particular issues with graphql-core in the corresponding repository. Please note that graphql core closely follows the reference implementation written in typescript in order to be as up to date as possible given our available maintainer time.
That's why I deem it unlikely to see any changes to the execution logic on just the python level. If you're interested in bringing this into graphql-js, it might be worthwhile to open up an RFC there and follow the process.
The limits functionality of graphene-protector look amazing. Are you interested in contributing them to strawberry-graphql or graphene directly so they're even easier to use? Feel free to contact me about both, I'm a core maintainer on both teams 😊
if you like to, we can move it. I proposed it a few years ago if I remember right. I would really like to develop this in a team.
from graphql-core.
What Erik wrote. Completely changing the execution or parsing logic is out of the scope of this project.
If it really would be a significant improvement, consider discussing this in the upstream GraphQL-js project.
Also, please note that a
max_tokens
parameter has been added to GraphQL-js and already ported to GraphQL-core. This could also help to avoid denial of service via memory exhaustion. Have you seen that?
I had some time to look through the code of the upstream project:
they seem to not to use a recursive pattern for parsing inputs, so they should be safe.
The max_token parameter is nice but doesn't prevent depths around 200 except it is configured very restrictive
They seem to be affected the same. I misread the code.
from graphql-core.
Maybe, instead of or in addition to max_tokens
, there should be something like max_level
? Is that something we should suggest?
from graphql-core.
Maybe, instead of or in addition to
max_tokens
, there should be something likemax_level
? Is that something we should suggest?
This solves a symptom and not the problem: Level > 200 depth is simply not supported.
An easy fix would just handle the crash and return an appropriate error (already done implicitly but without a nice error)
from graphql-core.
Note: currently there is no use in having 200 level depths of recursion but this can change if someone abuses strawberry-django filters for building really big filters.
from graphql-core.
Related Issues (20)
- Can you inject fields to an operation with a Visitor? HOT 2
- Use type guards for `language.predicates` HOT 1
- Trying to inject `id` field on every `selection_set` HOT 1
- Can default values form cycles? HOT 2
- Include name in representation of named nodes HOT 1
- performance issues due to breadth first execution of grapqhl queries in case of async resolvers during calls burst HOT 4
- A
- subscribe breaking change in graphql version 3.3.0a3 HOT 1
- [Question] How to map operation variables to their uses? HOT 2
- Using Relays in Graphql-core raises a TypeError HOT 4
- `out_name` is not respected for input objects used as default argument value
- Segfault during schema parsing HOT 3
- Segfault during schema parsing
- `graphql.utilities.print_schema` module contents are hidden behind `utilities` package
- `deepcopy` fails if the schema has a directive with an enum argument
- Both `typing.ByteString` and `typing.Text` are deprecated and slated for removal in Python 3.14 HOT 3
- Add the ability to specify `GraphQLResolveInfo.context` type HOT 1
- I use middleware for that right now HOT 1
- Cancel resolver tasks if execution of an operation is terminated HOT 7
Recommend Projects
-
React
A declarative, efficient, and flexible JavaScript library for building user interfaces.
-
Vue.js
🖖 Vue.js is a progressive, incrementally-adoptable JavaScript framework for building UI on the web.
-
Typescript
TypeScript is a superset of JavaScript that compiles to clean JavaScript output.
-
TensorFlow
An Open Source Machine Learning Framework for Everyone
-
Django
The Web framework for perfectionists with deadlines.
-
Laravel
A PHP framework for web artisans
-
D3
Bring data to life with SVG, Canvas and HTML. 📊📈🎉
-
Recommend Topics
-
javascript
JavaScript (JS) is a lightweight interpreted programming language with first-class functions.
-
web
Some thing interesting about web. New door for the world.
-
server
A server is a program made to process requests and deliver data to clients.
-
Machine learning
Machine learning is a way of modeling and interpreting data that allows a piece of software to respond intelligently.
-
Visualization
Some thing interesting about visualization, use data art
-
Game
Some thing interesting about game, make everyone happy.
Recommend Org
-
Facebook
We are working to build community through open source technology. NB: members must have two-factor auth.
-
Microsoft
Open source projects and samples from Microsoft.
-
Google
Google ❤️ Open Source for everyone.
-
Alibaba
Alibaba Open Source for everyone
-
D3
Data-Driven Documents codes.
-
Tencent
China tencent open source team.
from graphql-core.