Security - Add complexity max on gql queries (#16069)

closes https://github.com/twentyhq/private-issues/issues/348 closes https://github.com/twentyhq/private-issues/issues/352 closes https://github.com/twentyhq/private-issues/issues/353 closes https://github.com/twentyhq/private-issues/issues/354
2025-11-26 18:36:21 +01:00
parent 5202e2b2db
commit 70f48ba445
7 changed files with 90 additions and 2 deletions
@@ -0,0 +1,3 @@
+export const generateGqlFields = (count: number): string => {
+  return Array.from({ length: count }, (_) => `id`).join('\n');
+};
@@ -0,0 +1,38 @@
+import { generateGqlFields } from 'test/integration/graphql/suites/query-complexity/generate-gql-fields.util';
+import { findManyOperationFactory } from 'test/integration/graphql/utils/find-many-operation-factory.util';
+import { makeGraphqlAPIRequest } from 'test/integration/graphql/utils/make-graphql-api-request.util';
+
+describe('Query Complexity', () => {
+  it('should execute a simple query', async () => {
+    const gqlFields = generateGqlFields(100);
+
+    const findManyPeopleOperation = findManyOperationFactory({
+      objectMetadataSingularName: 'person',
+      objectMetadataPluralName: 'people',
+      gqlFields: gqlFields,
+    });
+
+    const response = await makeGraphqlAPIRequest(findManyPeopleOperation);
+
+    expect(response.body.errors).toBeUndefined();
+    expect(response.body.data.people).toBeDefined();
+    expect(response.body.data.people.edges).toBeDefined();
+  });
+
+  it('should fail to execute a query with too many fields', async () => {
+    const gqlFields = generateGqlFields(2001);
+
+    const findManyPeopleOperation = findManyOperationFactory({
+      objectMetadataSingularName: 'person',
+      objectMetadataPluralName: 'people',
+      gqlFields: gqlFields,
+    });
+
+    const response = await makeGraphqlAPIRequest(findManyPeopleOperation);
+
+    expect(response.body.errors).toBeDefined();
+    expect(response.body.errors[0].message).toContain(
+      'Query complexity is too high',
+    );
+  });
+});