feat: cost limit add fragment recursion cost

Escape-Technologies · Mar 17, 2023 · 0730bb5 · 0730bb5
1 parent 330a3a8
commit 0730bb5
Show file tree

Hide file tree

Showing 2 changed files with 8 additions and 1 deletion.
diff --git a/.changeset/tough-weeks-yawn.md b/.changeset/tough-weeks-yawn.md
@@ -0,0 +1,5 @@
+---
+'@escape.tech/graphql-armor-max-aliases': minor
+---
+
+add fragmentRecursionCost
diff --git a/packages/plugins/cost-limit/src/index.ts b/packages/plugins/cost-limit/src/index.ts
@@ -17,12 +17,14 @@ export type CostLimitOptions = {
   scalarCost?: number;
   depthCostFactor?: number;
   ignoreIntrospection?: boolean;
+  fragmentRecursionCost?: number;
 } & GraphQLArmorCallbackConfiguration;
 const costLimitDefaultOptions: Required<CostLimitOptions> = {
   maxCost: 5000,
   objectCost: 2,
   scalarCost: 1,
   depthCostFactor: 1.5,
+  fragmentRecursionCost: 1000,
   ignoreIntrospection: true,
   onAccept: [],
   onReject: [],
@@ -95,7 +97,7 @@ class CostLimitVisitor {
 
     if (node.kind == Kind.FRAGMENT_SPREAD) {
       if (this.visitedFragments.has(node.name.value)) {
-        return 0;
+        return this.config.fragmentRecursionCost;
       }
       this.visitedFragments.add(node.name.value);
       const fragment = this.context.getFragment(node.name.value);