You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
GraphQL uses query validators to check if Query AST is valid and can be executed. Every GraphQL server implements
4
+
standard query validators. For example, there is an validator that tests if queried field exists on queried type, that
5
+
makes query fail with "Cannot query field on type" error if it doesn't.
6
+
7
+
To help with common use cases, graphene provides a few validation rules out of the box.
8
+
9
+
10
+
Depth limit Validator
11
+
-----------------
12
+
The depth limit validator helps to prevent execution of malicious
13
+
queries. It takes in the following arguments.
14
+
15
+
- ``max_depth`` is the maximum allowed depth for any operation in a GraphQL document.
16
+
- ``ignore`` Stops recursive depth checking based on a field name. Either a string or regexp to match the name, or a function that returns a boolean
17
+
- ``callback`` Called each time validation runs. Receives an Object which is a map of the depths for each operation.
18
+
19
+
Usage
20
+
-------
21
+
22
+
Here is how you would implement depth-limiting on your schema.
23
+
24
+
.. code:: python
25
+
from graphql import validate, parse
26
+
from graphene import ObjectType, Schema, String
27
+
from graphene.validation import depth_limit_validator
28
+
29
+
30
+
classMyQuery(ObjectType):
31
+
name = String(required=True)
32
+
33
+
34
+
schema = Schema(query=MyQuery)
35
+
36
+
# queries which have a depth more than 20
37
+
# will not be executed.
38
+
39
+
validation_errors = validate(
40
+
schema=schema,
41
+
document_ast=parse('THE QUERY'),
42
+
rules=(
43
+
depth_limit_validator(
44
+
max_depth=20
45
+
),
46
+
)
47
+
)
48
+
49
+
50
+
Disable Introspection
51
+
---------------------
52
+
the disable introspection validation rule ensures that your schema cannot be introspected.
53
+
This is a useful security measure in production environments.
54
+
55
+
Usage
56
+
-------
57
+
58
+
Here is how you would disable introspection for your schema.
59
+
60
+
.. code:: python
61
+
from graphql import validate, parse
62
+
from graphene import ObjectType, Schema, String
63
+
from graphene.validation import DisableIntrospection
64
+
65
+
66
+
classMyQuery(ObjectType):
67
+
name = String(required=True)
68
+
69
+
70
+
schema = Schema(query=MyQuery)
71
+
72
+
# introspection queries will not be executed.
73
+
74
+
validation_errors = validate(
75
+
schema=schema,
76
+
document_ast=parse('THE QUERY'),
77
+
rules=(
78
+
DisableIntrospection,
79
+
)
80
+
)
81
+
82
+
83
+
Implementing custom validators
84
+
------------------------------
85
+
All custom query validators should extend the `ValidationRule <https://github.com/graphql-python/graphql-core/blob/v3.0.5/src/graphql/validation/rules/__init__.py#L37>`_
86
+
base class importable from the graphql.validation.rules module. Query validators are visitor classes. They are
87
+
instantiated at the time of query validation with one required argument (context: ASTValidationContext). In order to
88
+
perform validation, your validator class should define one or more of enter_* and leave_* methods. For possible
89
+
enter/leave items as well as details on function documentation, please see contents of the visitor module. To make
90
+
validation fail, you should call validator's report_error method with the instance of GraphQLError describing failure
91
+
reason. Here is an example query validator that visits field definitions in GraphQL query and fails query validation
92
+
if any of those fields are blacklisted:
93
+
94
+
.. code:: python
95
+
from graphql import GraphQLError
96
+
from graphql.language import FieldNode
97
+
from graphql.validation import ValidationRule
98
+
99
+
100
+
my_blacklist = (
101
+
"disallowed_field",
102
+
)
103
+
104
+
105
+
defis_blacklisted_field(field_name: str):
106
+
return field_name.lower() in my_blacklist
107
+
108
+
109
+
classBlackListRule(ValidationRule):
110
+
defenter_field(self, node: FieldNode, *_args):
111
+
field_name = node.name.value
112
+
ifnot is_blacklisted_field(field_name):
113
+
return
114
+
115
+
self.report_error(
116
+
GraphQLError(
117
+
f"Cannot query '{field_name}': field is blacklisted.", node,
0 commit comments