nic-6443 opened a new pull request, #13830: URL: https://github.com/apache/apisix/pull/13830
### Description `node_depth()` in `graphql-limit-count` clears `visited[name]` right after walking a fragment spread, so the same fragment is walked again from every spread that references it. A document where each fragment spreads the next one twice therefore costs `2^n` traversals for `n` fragments — a ~1KB body reaches a billion node visits, and that runs in the `access` phase on an unauthenticated request, before the rate limit the plugin enforces. #1389 capped the body at 1MB, which still leaves plenty of room for this. A fragment's depth doesn't depend on where it is spread from, so it's now computed once per document and memoized. The depth the plugin reports is unchanged; only the traversal cost is, from exponential to linear in the number of fragments. The new test in `t/plugin/graphql-limit-count.t` sends a 26-fragment document of that shape and asserts the resulting quota consumption. It passes in milliseconds with this change and times out on master. #### Which issue(s) this PR fixes: N/A ### Checklist - [x] I have explained the need for this PR and the problem it solves - [x] I have explained the changes or the new features added to this PR - [x] I have added tests corresponding to this change - [ ] I have updated the documentation to reflect this change — no user visible behaviour change - [x] I have verified that this change is backward compatible (If not, please discuss on the [APISIX mailing list](https://github.com/apache/apisix/tree/master#community) first) -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
