feat: add misc graphql validation rules #686
Conversation
…s usage for graphene Signed-off-by: rohan <rohan.chaturvedi@protonmail.com>
There was a problem hiding this comment.
Pull Request Overview
This PR upgrades graphene-django from version 3.0.0 to 3.2.0 and introduces custom GraphQL validation rules to protect against potential DoS attacks through excessive duplicate fields and alias usage.
Key changes:
- Updated
graphene-djangodependency to version 3.2.0 - Added two custom validation rules:
DuplicateFieldLimitRuleandAliasUsageLimitRulewith configurable limits (default: 50 each) - Integrated the custom validation rules into the
PrivateGraphQLViewalongside the standard GraphQL validation rules
Reviewed Changes
Copilot reviewed 3 out of 3 changed files in this pull request and generated 4 comments.
| File | Description |
|---|---|
| backend/requirements.txt | Upgraded graphene-django from 3.0.0 to 3.2.0 |
| backend/backend/graphene/validation.py | Introduced new validation rules to limit duplicate field requests and alias usage in GraphQL queries |
| backend/api/views/graphql.py | Integrated custom validation rules into the PrivateGraphQLView class |
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
Signed-off-by: rohan <rohan.chaturvedi@protonmail.com>
There was a problem hiding this comment.
Pull Request Overview
Copilot reviewed 3 out of 3 changed files in this pull request and generated 1 comment.
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
|
@cursor review |
![cursor[bot]](https://avatars.githubusercontent.com/in/1210556?s=60&v=4){kind=small}
Signed-off-by: rohan <rohan.chaturvedi@protonmail.com>
Signed-off-by: rohan <rohan.chaturvedi@protonmail.com>
rohan-chaturvedi
changed the title
There was a problem hiding this comment.
Pull Request Overview
Copilot reviewed 5 out of 5 changed files in this pull request and generated 5 comments.
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
|
@cursor review |
* refactor: use standardized get_client_ip util Signed-off-by: rohan <rohan.chaturvedi@protonmail.com> * refactor: simplify IP retrieval in IsIPAllowed permission class by using get_client_ip utility * refactor: streamline client IP retrieval in IPWhitelistMiddleware by utilizing get_client_ip utility * refactor: enhance get_client_ip utility to validate IP addresses and improve retrieval logic * debug: add print statement to log raw IP address in get_client_ip utility * chore: add a blank line at the end of ip.py for consistency * refactor: update client IP retrieval logic in get_client_ip utility to prioritize HTTP_X_REAL_IP * refactor: remove debug print statement from get_client_ip utility * fix: remove unnecessary fallbacks Signed-off-by: rohan <rohan.chaturvedi@protonmail.com> --------- Signed-off-by: rohan <rohan.chaturvedi@protonmail.com> Co-authored-by: rohan <rohan.chaturvedi@protonmail.com>
Signed-off-by: rohan <rohan.chaturvedi@protonmail.com>
Signed-off-by: rohan <rohan.chaturvedi@protonmail.com>
|
@cursor review |
Signed-off-by: rohan <rohan.chaturvedi@protonmail.com>
🔍 Overview
Note
Adds GraphQL validation, centralizes validated client IP extraction, and tightens access controls for invites, roles, service accounts, and secret/environment mutations.
DuplicateFieldLimitRuleandAliasUsageLimitRuleinbackend/graphene/validation.pyand enable viaPrivateGraphQLView.validation_rules.get_client_ipinbackend/graphene/middleware.py.developer/service; block changing one’s own role inUpdateOrganisationMemberRole.user_can_access_environmentchecks to bulk/individual secret mutations and related folder ops.api.utils.access.ip.get_client_ip(validatedHTTP_X_REAL_IP) and replace ad-hoc implementations acrossemails.py,utils/rest.py,utils/access/middleware.py,views/kms.py, Graphene middleware, andqueries/access.py.graphene-djangoto3.2.0inbackend/requirements.txt.Written by Cursor Bugbot for commit da65c38. Configure here.