This is an automated email from the ASF dual-hosted git repository.
radu pushed a commit to branch master
in repository
https://gitbox.apache.org/repos/asf/sling-org-apache-sling-graphql-core.git
The following commit(s) were added to refs/heads/master by this push:
new 4aa659a SLING-12770 - Upgrade graphql-java version to 24.0
4aa659a is described below
commit 4aa659a4de384cb45e4a648a9e11a426bcdc4a1d
Author: Martin Schulze <[email protected]>
AuthorDate: Mon May 19 10:33:31 2025 +0200
SLING-12770 - Upgrade graphql-java version to 24.0
* added a maxFieldCount config to DefaultQueryExecutor, with a default of
100_000,
the default of the graphql-java
* added a unit test for setting the config
---------
Co-authored-by: Martin Schulze <[email protected]>
---
pom.xml | 4 ++--
.../sling/graphql/core/engine/DefaultQueryExecutor.java | 9 +++++++++
.../core/engine/DefaultQueryExecutorLoggingTest.java | 4 ++--
.../graphql/core/engine/DefaultQueryExecutorTest.java | 15 +++++++++++++++
.../sling/graphql/core/engine/MaxQueryTokensTest.java | 6 +++---
5 files changed, 31 insertions(+), 7 deletions(-)
diff --git a/pom.xml b/pom.xml
index 04ac8d8..4163230 100644
--- a/pom.xml
+++ b/pom.xml
@@ -127,13 +127,13 @@
<dependency>
<groupId>com.graphql-java</groupId>
<artifactId>graphql-java</artifactId>
- <version>20.3</version>
+ <version>24.0</version>
<scope>provided</scope>
</dependency>
<dependency>
<groupId>com.graphql-java</groupId>
<artifactId>java-dataloader</artifactId>
- <version>3.2.0</version>
+ <version>5.0.0</version>
<scope>provided</scope>
</dependency>
<dependency>
diff --git
a/src/main/java/org/apache/sling/graphql/core/engine/DefaultQueryExecutor.java
b/src/main/java/org/apache/sling/graphql/core/engine/DefaultQueryExecutor.java
index aa5a975..ac16f15 100644
---
a/src/main/java/org/apache/sling/graphql/core/engine/DefaultQueryExecutor.java
+++
b/src/main/java/org/apache/sling/graphql/core/engine/DefaultQueryExecutor.java
@@ -75,6 +75,7 @@ import graphql.language.StringValue;
import graphql.language.TypeDefinition;
import graphql.language.TypeName;
import graphql.language.UnionTypeDefinition;
+import graphql.normalized.ExecutableNormalizedOperationFactory;
import graphql.schema.DataFetcher;
import graphql.schema.GraphQLScalarType;
import graphql.schema.GraphQLSchema;
@@ -157,6 +158,13 @@ public class DefaultQueryExecutor implements QueryExecutor
{
" Change ONLY if you know exactly what you are doing."
)
int maxWhitespaceTokens() default 200000;
+
+ @AttributeDefinition(
+ name = "Maximum Field Count",
+ description = "The number of fields queried with an GraphQL
request. This is a safety measure to avoid denial of service attacks." +
+ " Change ONLY if you know exactly what you are doing."
+ )
+ int maxFieldCount() default 100000;
}
private class ExecutionContext {
@@ -203,6 +211,7 @@ public class DefaultQueryExecutor implements QueryExecutor {
resourceToHashMap = new LRUCache<>(schemaCacheSize);
hashToSchemaMap = new LRUCache<>(schemaCacheSize);
+
ExecutableNormalizedOperationFactory.Options.setDefaultOptions(ExecutableNormalizedOperationFactory.Options.defaultOptions().maxFieldsCount(config.maxFieldCount()));
}
@Override
diff --git
a/src/test/java/org/apache/sling/graphql/core/engine/DefaultQueryExecutorLoggingTest.java
b/src/test/java/org/apache/sling/graphql/core/engine/DefaultQueryExecutorLoggingTest.java
index a0a74fd..f4ef843 100644
---
a/src/test/java/org/apache/sling/graphql/core/engine/DefaultQueryExecutorLoggingTest.java
+++
b/src/test/java/org/apache/sling/graphql/core/engine/DefaultQueryExecutorLoggingTest.java
@@ -82,9 +82,9 @@ public class DefaultQueryExecutorLoggingTest extends
ResourceQueryTestBase {
capture.assertContains(
Level.ERROR,
"Query failed for Resource " + resource.getPath(),
- "query=" + invalidQuery,
+ "query=INVALID",
"Errors:Error: type=InvalidSyntax",
- "message=Invalid syntax with ANTLR error 'token recognition error
at: '4ec'' at line 1 column 9",
+ "message=Invalid syntax with offending token 'INVALID' at line 1
column 1",
String.format("selectors=%s", Arrays.toString(selectors))
);
}
diff --git
a/src/test/java/org/apache/sling/graphql/core/engine/DefaultQueryExecutorTest.java
b/src/test/java/org/apache/sling/graphql/core/engine/DefaultQueryExecutorTest.java
index d70179e..0583273 100644
---
a/src/test/java/org/apache/sling/graphql/core/engine/DefaultQueryExecutorTest.java
+++
b/src/test/java/org/apache/sling/graphql/core/engine/DefaultQueryExecutorTest.java
@@ -52,10 +52,12 @@ import org.apache.sling.graphql.core.mocks.TestUtil;
import org.apache.sling.graphql.core.schema.RankedSchemaProviders;
import org.apache.sling.testing.mock.osgi.MockOsgi;
import org.junit.Test;
+import org.mockito.Mockito;
import org.osgi.framework.Constants;
import org.osgi.framework.ServiceReference;
import org.osgi.framework.ServiceRegistration;
+import graphql.normalized.ExecutableNormalizedOperationFactory;
import graphql.schema.idl.TypeDefinitionRegistry;
import static com.jayway.jsonpath.matchers.JsonPathMatchers.hasJsonPath;
@@ -510,4 +512,17 @@ public class DefaultQueryExecutorTest extends
ResourceQueryTestBase {
}
+ @Test
+ public void testMaxFieldCountConfig() {
+ DefaultQueryExecutor.Config config =
Mockito.mock(DefaultQueryExecutor.Config.class);
+ Mockito.when(config.maxFieldCount()).thenReturn(1000);
+
+ DefaultQueryExecutor executor = new DefaultQueryExecutor();
+ executor.activate(config);
+
+ int expectedMaxFieldCount = 1000;
+ int actualMaxFieldCount =
ExecutableNormalizedOperationFactory.Options.defaultOptions().getMaxFieldsCount();
+
+ assertEquals("Max field count should match the configured value",
expectedMaxFieldCount, actualMaxFieldCount);
+ }
}
diff --git
a/src/test/java/org/apache/sling/graphql/core/engine/MaxQueryTokensTest.java
b/src/test/java/org/apache/sling/graphql/core/engine/MaxQueryTokensTest.java
index 0c10ce0..d81d22c 100644
--- a/src/test/java/org/apache/sling/graphql/core/engine/MaxQueryTokensTest.java
+++ b/src/test/java/org/apache/sling/graphql/core/engine/MaxQueryTokensTest.java
@@ -45,7 +45,7 @@ import static org.hamcrest.Matchers.containsString;
public class MaxQueryTokensTest extends ResourceQueryTestBase {
private static final int DEFAULT_MAX_QUERY_TOKENS = 15000;
private static final String INVALID = "invalid ";
- private static final String WHITESPACE = " {\t";
+ private static final String WHITESPACE = " \t";
private final Integer maxQueryTokens;
private final Integer maxWhitespaceTokens;
private final int nOk;
@@ -115,14 +115,14 @@ public class MaxQueryTokensTest extends
ResourceQueryTestBase {
@Test
public void tooManyTokens() throws Exception {
- assertQueryFailure(repeat(INVALID, nTokensFailure),
+ assertQueryFailure("{" + repeat(INVALID, nTokensFailure) + "}",
"'grammar' tokens have been presented. To prevent Denial Of Service");
}
@Test
public void tooManyWhitespaceTokens() throws Exception {
if (nWhitespaceFailure >= 0) {
- assertQueryFailure(repeat(WHITESPACE, nWhitespaceFailure),
+ assertQueryFailure("{" + repeat(WHITESPACE, nWhitespaceFailure) + "}",
"'whitespace' tokens have been presented. To prevent Denial Of
Service");
}
}
