Merge pull request #1581 from tsh96/master

Bypass complexity limit on __Schema queries.
99designs · Sep 8, 2021 · 8f179be · 8f179be
2 parents 5048f99 + 5adb73b
commit 8f179be
Show file tree

Hide file tree

Showing 2 changed files with 15 additions and 0 deletions.
diff --git a/complexity/complexity.go b/complexity/complexity.go
@@ -26,6 +26,11 @@ func (cw complexityWalker) selectionSetComplexity(selectionSet ast.SelectionSet)
 		switch s := selection.(type) {
 		case *ast.Field:
 			fieldDefinition := cw.schema.Types[s.Definition.Type.Name()]
+
+			if fieldDefinition.Name == "__Schema" {
+				continue
+			}
+
 			var childComplexity int
 			switch fieldDefinition.Kind {
 			case ast.Object, ast.Interface, ast.Union:

diff --git a/graphql/handler/extension/complexity_test.go b/graphql/handler/extension/complexity_test.go
@@ -95,6 +95,16 @@ func TestFixedComplexity(t *testing.T) {
 		require.Equal(t, 2, stats.ComplexityLimit)
 		require.Equal(t, 4, stats.Complexity)
 	})
+
+	t.Run("bypass __schema field", func(t *testing.T) {
+		h.SetCalculatedComplexity(4)
+		resp := doRequest(h, "POST", "/graphql", `{ "operationName":"IntrospectionQuery", "query":"query IntrospectionQuery { __schema { queryType { name } mutationType { name }}}"}`)
+		require.Equal(t, http.StatusOK, resp.Code, resp.Body.String())
+		require.Equal(t, `{"data":{"name":"test"}}`, resp.Body.String())
+
+		require.Equal(t, 2, stats.ComplexityLimit)
+		require.Equal(t, 0, stats.Complexity)
+	})
 }
 
 func doRequest(handler http.Handler, method string, target string, body string) *httptest.ResponseRecorder {