Security - Add complexity max on gql queries (#16069)

closes https://github.com/twentyhq/private-issues/issues/348 closes https://github.com/twentyhq/private-issues/issues/352 closes https://github.com/twentyhq/private-issues/issues/353 closes https://github.com/twentyhq/private-issues/issues/354
2025-11-26 18:36:21 +01:00
parent 5202e2b2db
commit 70f48ba445
7 changed files with 90 additions and 2 deletions
@@ -986,6 +986,14 @@ export class ConfigVariables {
  @CastToPositiveNumber()
  API_RATE_LIMITING_LONG_LIMIT = 100;

+  @CastToPositiveNumber()
+  @ConfigVariablesMetadata({
+    group: ConfigVariablesGroup.RATE_LIMITING,
+    description: 'Maximum complexity allowed for GQL queries',
+    type: ConfigVariableType.NUMBER,
+  })
+  GRAPHQL_MAX_COMPLEXITY = 2000;
+
  @ConfigVariablesMetadata({
    group: ConfigVariablesGroup.SSL,
    description: 'Path to the SSL key for enabling HTTPS in local development',