Fork me on GitHub
#graphql
<
2020-11-11
>
chrisulloa01:11:58

Does Lacinia do any validation on highly recursive or nested queries? Is there a depth limit? I know a common DOS attack is to find highly recursive, self-referencing objects.

orestis05:11:04

No, it doesn’t, but AFAIK it exposes the parsed query before execution so you can do this yourself.

👍 3
hlship17:11:43

There's an existing issue about checking for this; essentially a fragment should not be able to loop back (directly or indirectly) to itself.