feat(max-aliases): add an allow list of unlimited aliases name (#540)

* feat(max-aliases): add an allow list of unlimited aliases name * feat: changeset --------- Co-authored-by: c3b5aw <[email protected]>
Escape-Technologies · Oct 26, 2023 · a21f0f4 · a21f0f4
1 parent e13c4db
commit a21f0f4
Show file tree

Hide file tree

Showing 3 changed files with 24 additions and 2 deletions.
diff --git a/.changeset/cyan-crews-do.md b/.changeset/cyan-crews-do.md
@@ -0,0 +1,5 @@
+---
+'@escape.tech/graphql-armor-max-aliases': minor
+---
+
+add allowList
diff --git a/packages/plugins/max-aliases/src/index.ts b/packages/plugins/max-aliases/src/index.ts
@@ -11,12 +11,13 @@ import {
   ValidationContext,
 } from 'graphql';
 
-type MaxAliasesOptions = { n?: number } & GraphQLArmorCallbackConfiguration;
+type MaxAliasesOptions = { n?: number; allowList: string[] } & GraphQLArmorCallbackConfiguration;
 const maxAliasesDefaultOptions: Required<MaxAliasesOptions> = {
   n: 15,
   onAccept: [],
   onReject: [],
   propagateOnRejection: true,
+  allowList: [],
 };
 
 class MaxAliasesVisitor {
@@ -63,7 +64,7 @@ class MaxAliasesVisitor {
     node: FieldNode | FragmentDefinitionNode | InlineFragmentNode | OperationDefinitionNode | FragmentSpreadNode,
   ): number {
     let aliases = 0;
-    if ('alias' in node && node.alias) {
+    if ('alias' in node && node.alias && !this.config.allowList.includes(node.alias.value)) {
       ++aliases;
     }
     if ('selectionSet' in node && node.selectionSet) {

diff --git a/packages/plugins/max-aliases/test/index.spec.ts b/packages/plugins/max-aliases/test/index.spec.ts
@@ -122,4 +122,20 @@ describe('global', () => {
     expect(result.errors).toBeDefined();
     expect(result.errors?.map((error) => error.message)).toContain('Cannot spread fragment "A" within itself via "B".');
   });
+
+  it('should not reject allowed aliases', async () => {
+    const maxAliases = 1;
+    const testkit = createTestkit([maxAliasesPlugin({ n: maxAliases, allowList: ['allowed'] })], schema);
+    const result = await testkit.execute(`query {
+      allowed: getBook(title: "null") {
+        allowed: author
+      }
+    }`);
+
+    assertSingleExecutionValue(result);
+    expect(result.errors).toBeUndefined();
+    expect(result.data).toEqual({
+      allowed: null,
+    });
+  });
 });