@vendure/harden-plugin 3.1.8 → 3.2.1
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
package/LICENSE.md
CHANGED
|
@@ -1,42 +1,42 @@
|
|
|
1
|
-
# License
|
|
2
|
-
Copyright (C) Vendure GmbH
|
|
3
|
-
|
|
4
|
-
This software is available under two different licenses:
|
|
5
|
-
* GNU General Public License version 3 (GPLv3) as Vendure Community Edition
|
|
6
|
-
* Vendure Commercial License (VCL)
|
|
7
|
-
|
|
8
|
-
The default Vendure license, without a valid Vendure Commercial License agreement, is the Open-Source GPLv3 license.
|
|
9
|
-
|
|
10
|
-
## GNU General Public License version 3 (GPLv3)
|
|
11
|
-
|
|
12
|
-
If you decide to choose the GPLv3 license, you must comply with the following terms:
|
|
13
|
-
|
|
14
|
-
This program is free software: you can redistribute it and/or modify
|
|
15
|
-
it under the terms of the GNU General Public License as published by
|
|
16
|
-
the Free Software Foundation, either version 3 of the License, or
|
|
17
|
-
(at your option) any later version.
|
|
18
|
-
|
|
19
|
-
This program is distributed in the hope that it will be useful,
|
|
20
|
-
but WITHOUT ANY WARRANTY; without even the implied warranty of
|
|
21
|
-
MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
|
|
22
|
-
GNU General Public License for more details.
|
|
23
|
-
|
|
24
|
-
You should have received a copy of the GNU General Public License
|
|
25
|
-
along with this program. If not, see <http://www.gnu.org/licenses/>.
|
|
26
|
-
|
|
27
|
-
Additional permission under GNU GPL version 3 section 7:
|
|
28
|
-
|
|
29
|
-
An additional exception under section 7 of the GPL is included in the plugin-exception.txt file,
|
|
30
|
-
which allows you to distribute Vendure plugins (i.e. extensions) under a different license.
|
|
31
|
-
|
|
32
|
-
## Vendure Commercial License (VCL)
|
|
33
|
-
|
|
34
|
-
Alternatively, commercial and supported versions of the program - also known as
|
|
35
|
-
Commercial Distributions - must be used in accordance with the terms and conditions
|
|
36
|
-
contained in a separate written agreement between you and Vendure GmbH.
|
|
37
|
-
For more information about the Vendure Commercial License (VCL) please contact contact@vendure.io.
|
|
38
|
-
|
|
39
|
-
Please see also:
|
|
40
|
-
|
|
41
|
-
- [Licensing FAQ - license-faq.md](license/license-faq.md)
|
|
42
|
-
- [GNU GENERAL PUBLIC LICENSE Version 3, 29 June 2007 - gpl-3.0.txt](license/gpl-3.0.txt)
|
|
1
|
+
# License
|
|
2
|
+
Copyright (C) Vendure GmbH
|
|
3
|
+
|
|
4
|
+
This software is available under two different licenses:
|
|
5
|
+
* GNU General Public License version 3 (GPLv3) as Vendure Community Edition
|
|
6
|
+
* Vendure Commercial License (VCL)
|
|
7
|
+
|
|
8
|
+
The default Vendure license, without a valid Vendure Commercial License agreement, is the Open-Source GPLv3 license.
|
|
9
|
+
|
|
10
|
+
## GNU General Public License version 3 (GPLv3)
|
|
11
|
+
|
|
12
|
+
If you decide to choose the GPLv3 license, you must comply with the following terms:
|
|
13
|
+
|
|
14
|
+
This program is free software: you can redistribute it and/or modify
|
|
15
|
+
it under the terms of the GNU General Public License as published by
|
|
16
|
+
the Free Software Foundation, either version 3 of the License, or
|
|
17
|
+
(at your option) any later version.
|
|
18
|
+
|
|
19
|
+
This program is distributed in the hope that it will be useful,
|
|
20
|
+
but WITHOUT ANY WARRANTY; without even the implied warranty of
|
|
21
|
+
MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
|
|
22
|
+
GNU General Public License for more details.
|
|
23
|
+
|
|
24
|
+
You should have received a copy of the GNU General Public License
|
|
25
|
+
along with this program. If not, see <http://www.gnu.org/licenses/>.
|
|
26
|
+
|
|
27
|
+
Additional permission under GNU GPL version 3 section 7:
|
|
28
|
+
|
|
29
|
+
An additional exception under section 7 of the GPL is included in the plugin-exception.txt file,
|
|
30
|
+
which allows you to distribute Vendure plugins (i.e. extensions) under a different license.
|
|
31
|
+
|
|
32
|
+
## Vendure Commercial License (VCL)
|
|
33
|
+
|
|
34
|
+
Alternatively, commercial and supported versions of the program - also known as
|
|
35
|
+
Commercial Distributions - must be used in accordance with the terms and conditions
|
|
36
|
+
contained in a separate written agreement between you and Vendure GmbH.
|
|
37
|
+
For more information about the Vendure Commercial License (VCL) please contact contact@vendure.io.
|
|
38
|
+
|
|
39
|
+
Please see also:
|
|
40
|
+
|
|
41
|
+
- [Licensing FAQ - license-faq.md](license/license-faq.md)
|
|
42
|
+
- [GNU GENERAL PUBLIC LICENSE Version 3, 29 June 2007 - gpl-3.0.txt](license/gpl-3.0.txt)
|
package/README.md
CHANGED
|
@@ -1,7 +1,7 @@
|
|
|
1
|
-
# Vendure Harden Plugin
|
|
2
|
-
|
|
3
|
-
Hardens your Vendure GraphQL APIs against attacks.
|
|
4
|
-
|
|
5
|
-
`npm install @vendure/harden-plugin`
|
|
6
|
-
|
|
7
|
-
For documentation, see [docs.vendure.io/reference/core-plugins/harden-plugin/](https://docs.vendure.io/reference/core-plugins/harden-plugin/)
|
|
1
|
+
# Vendure Harden Plugin
|
|
2
|
+
|
|
3
|
+
Hardens your Vendure GraphQL APIs against attacks.
|
|
4
|
+
|
|
5
|
+
`npm install @vendure/harden-plugin`
|
|
6
|
+
|
|
7
|
+
For documentation, see [docs.vendure.io/reference/core-plugins/harden-plugin/](https://docs.vendure.io/reference/core-plugins/harden-plugin/)
|
|
@@ -8,7 +8,7 @@ import { HardenPluginOptions } from '../types';
|
|
|
8
8
|
export declare class QueryComplexityPlugin implements ApolloServerPlugin {
|
|
9
9
|
private options;
|
|
10
10
|
constructor(options: HardenPluginOptions);
|
|
11
|
-
requestDidStart(
|
|
11
|
+
requestDidStart(context: GraphQLRequestContext<any>): Promise<GraphQLRequestListener<any>>;
|
|
12
12
|
}
|
|
13
13
|
/**
|
|
14
14
|
* @description
|
|
@@ -1,6 +1,7 @@
|
|
|
1
1
|
"use strict";
|
|
2
2
|
Object.defineProperty(exports, "__esModule", { value: true });
|
|
3
|
-
exports.
|
|
3
|
+
exports.QueryComplexityPlugin = void 0;
|
|
4
|
+
exports.defaultVendureComplexityEstimator = defaultVendureComplexityEstimator;
|
|
4
5
|
const core_1 = require("@vendure/core");
|
|
5
6
|
const graphql_1 = require("graphql");
|
|
6
7
|
const graphql_query_complexity_1 = require("graphql-query-complexity");
|
|
@@ -13,38 +14,42 @@ class QueryComplexityPlugin {
|
|
|
13
14
|
constructor(options) {
|
|
14
15
|
this.options = options;
|
|
15
16
|
}
|
|
16
|
-
async requestDidStart(
|
|
17
|
+
async requestDidStart(context) {
|
|
17
18
|
var _a;
|
|
18
19
|
const maxQueryComplexity = (_a = this.options.maxQueryComplexity) !== null && _a !== void 0 ? _a : 1000;
|
|
19
20
|
return {
|
|
20
21
|
didResolveOperation: async ({ request, document }) => {
|
|
21
|
-
var _a, _b, _c, _d, _e, _f;
|
|
22
|
-
if (isAdminApi(schema)) {
|
|
22
|
+
var _a, _b, _c, _d, _e, _f, _g, _h;
|
|
23
|
+
if (isAdminApi(context.schema)) {
|
|
23
24
|
// We don't want to apply the cost analysis on the
|
|
24
25
|
// Admin API, since any expensive operations would require
|
|
25
26
|
// an authenticated session.
|
|
26
27
|
return;
|
|
27
28
|
}
|
|
29
|
+
if (await ((_b = (_a = this.options).skip) === null || _b === void 0 ? void 0 : _b.call(_a, context))) {
|
|
30
|
+
// Given skip function tells use we should not check this request for complexity
|
|
31
|
+
return;
|
|
32
|
+
}
|
|
28
33
|
const query = request.operationName
|
|
29
34
|
? (0, graphql_1.separateOperations)(document)[request.operationName]
|
|
30
35
|
: document;
|
|
31
36
|
if (this.options.logComplexityScore === true) {
|
|
32
|
-
core_1.Logger.debug(`Calculating complexity of "${(
|
|
37
|
+
core_1.Logger.debug(`Calculating complexity of "${(_c = request.operationName) !== null && _c !== void 0 ? _c : 'anonymous'}"`, constants_1.loggerCtx);
|
|
33
38
|
}
|
|
34
39
|
const complexity = (0, graphql_query_complexity_1.getComplexity)({
|
|
35
|
-
schema,
|
|
40
|
+
schema: context.schema,
|
|
36
41
|
query,
|
|
37
42
|
variables: request.variables,
|
|
38
|
-
estimators: (
|
|
39
|
-
defaultVendureComplexityEstimator((
|
|
43
|
+
estimators: (_d = this.options.queryComplexityEstimators) !== null && _d !== void 0 ? _d : [
|
|
44
|
+
defaultVendureComplexityEstimator((_e = this.options.customComplexityFactors) !== null && _e !== void 0 ? _e : {}, (_f = this.options.logComplexityScore) !== null && _f !== void 0 ? _f : false),
|
|
40
45
|
(0, graphql_query_complexity_1.simpleEstimator)({ defaultComplexity: 1 }),
|
|
41
46
|
],
|
|
42
47
|
});
|
|
43
48
|
if (this.options.logComplexityScore === true) {
|
|
44
|
-
core_1.Logger.verbose(`Query complexity "${(
|
|
49
|
+
core_1.Logger.verbose(`Query complexity "${(_g = request.operationName) !== null && _g !== void 0 ? _g : 'anonymous'}": ${complexity}`, constants_1.loggerCtx);
|
|
45
50
|
}
|
|
46
51
|
if (complexity >= maxQueryComplexity) {
|
|
47
|
-
core_1.Logger.error(`Query complexity of "${(
|
|
52
|
+
core_1.Logger.error(`Query complexity of "${(_h = request.operationName) !== null && _h !== void 0 ? _h : 'anonymous'}" is ${complexity}, which exceeds the maximum of ${maxQueryComplexity}`, constants_1.loggerCtx);
|
|
48
53
|
throw new core_1.InternalServerError('Query is too complex');
|
|
49
54
|
}
|
|
50
55
|
},
|
|
@@ -98,5 +103,4 @@ function defaultVendureComplexityEstimator(customComplexityFactors, logFieldScor
|
|
|
98
103
|
return result;
|
|
99
104
|
};
|
|
100
105
|
}
|
|
101
|
-
exports.defaultVendureComplexityEstimator = defaultVendureComplexityEstimator;
|
|
102
106
|
//# sourceMappingURL=query-complexity-plugin.js.map
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"query-complexity-plugin.js","sourceRoot":"","sources":["../../../src/middleware/query-complexity-plugin.ts"],"names":[],"mappings":";;;
|
|
1
|
+
{"version":3,"file":"query-complexity-plugin.js","sourceRoot":"","sources":["../../../src/middleware/query-complexity-plugin.ts"],"names":[],"mappings":";;;AAiGA,8EAgCC;AAhID,wCAA4D;AAC5D,qCAOiB;AACjB,uEAAmG;AAEnG,4CAAyC;AAGzC;;;GAGG;AACH,MAAa,qBAAqB;IAC9B,YAAoB,OAA4B;QAA5B,YAAO,GAAP,OAAO,CAAqB;IAAG,CAAC;IAEpD,KAAK,CAAC,eAAe,CAAC,OAAmC;;QACrD,MAAM,kBAAkB,GAAG,MAAA,IAAI,CAAC,OAAO,CAAC,kBAAkB,mCAAI,IAAI,CAAC;QACnE,OAAO;YACH,mBAAmB,EAAE,KAAK,EAAE,EAAE,OAAO,EAAE,QAAQ,EAAE,EAAE,EAAE;;gBACjD,IAAI,UAAU,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC;oBAC7B,kDAAkD;oBAClD,0DAA0D;oBAC1D,4BAA4B;oBAC5B,OAAO;gBACX,CAAC;gBACD,IAAI,MAAM,CAAA,MAAA,MAAA,IAAI,CAAC,OAAO,EAAC,IAAI,mDAAG,OAAO,CAAC,CAAA,EAAE,CAAC;oBACrC,gFAAgF;oBAChF,OAAO;gBACX,CAAC;gBACD,MAAM,KAAK,GAAG,OAAO,CAAC,aAAa;oBAC/B,CAAC,CAAC,IAAA,4BAAkB,EAAC,QAAQ,CAAC,CAAC,OAAO,CAAC,aAAa,CAAC;oBACrD,CAAC,CAAC,QAAQ,CAAC;gBAEf,IAAI,IAAI,CAAC,OAAO,CAAC,kBAAkB,KAAK,IAAI,EAAE,CAAC;oBAC3C,aAAM,CAAC,KAAK,CACR,8BAA8B,MAAA,OAAO,CAAC,aAAa,mCAAI,WAAW,GAAG,EACrE,qBAAS,CACZ,CAAC;gBACN,CAAC;gBACD,MAAM,UAAU,GAAG,IAAA,wCAAa,EAAC;oBAC7B,MAAM,EAAE,OAAO,CAAC,MAAM;oBACtB,KAAK;oBACL,SAAS,EAAE,OAAO,CAAC,SAAS;oBAC5B,UAAU,EAAE,MAAA,IAAI,CAAC,OAAO,CAAC,yBAAyB,mCAAI;wBAClD,iCAAiC,CAC7B,MAAA,IAAI,CAAC,OAAO,CAAC,uBAAuB,mCAAI,EAAE,EAC1C,MAAA,IAAI,CAAC,OAAO,CAAC,kBAAkB,mCAAI,KAAK,CAC3C;wBACD,IAAA,0CAAe,EAAC,EAAE,iBAAiB,EAAE,CAAC,EAAE,CAAC;qBAC5C;iBACJ,CAAC,CAAC;gBAEH,IAAI,IAAI,CAAC,OAAO,CAAC,kBAAkB,KAAK,IAAI,EAAE,CAAC;oBAC3C,aAAM,CAAC,OAAO,CACV,qBAAqB,MAAA,OAAO,CAAC,aAAa,mCAAI,WAAW,MAAM,UAAU,EAAE,EAC3E,qBAAS,CACZ,CAAC;gBACN,CAAC;gBACD,IAAI,UAAU,IAAI,kBAAkB,EAAE,CAAC;oBACnC,aAAM,CAAC,KAAK,CACR,wBACI,MAAA,OAAO,CAAC,aAAa,mCAAI,WAC7B,QAAQ,UAAU,kCAAkC,kBAAkB,EAAE,EACxE,qBAAS,CACZ,CAAC;oBACF,MAAM,IAAI,0BAAmB,CAAC,sBAAsB,CAAC,CAAC;gBAC1D,CAAC;YACL,CAAC;SACJ,CAAC;IACN,CAAC;CACJ;AA1DD,sDA0DC;AAED,SAAS,UAAU,CAAC,MAAqB;IACrC,MAAM,SAAS,GAAG,MAAM,CAAC,YAAY,EAAE,CAAC;IACxC,IAAI,SAAS,EAAE,CAAC;QACZ,OAAO,CAAC,CAAC,SAAS,CAAC,SAAS,EAAE,CAAC,cAAc,CAAC;IAClD,CAAC;IACD,OAAO,KAAK,CAAC;AACjB,CAAC;AAED;;;;;;;;;GASG;AACH,SAAgB,iCAAiC,CAC7C,uBAAmD,EACnD,cAAuB;IAEvB,OAAO,CAAC,OAAgC,EAAiB,EAAE;;QACvD,MAAM,EAAE,IAAI,EAAE,IAAI,EAAE,eAAe,EAAE,KAAK,EAAE,GAAG,OAAO,CAAC;QACvD,MAAM,SAAS,GAAG,IAAA,sBAAY,EAAC,KAAK,CAAC,IAAI,CAAC,CAAC;QAC3C,MAAM,IAAI,GAAG,GAAG,IAAI,CAAC,IAAI,IAAI,KAAK,CAAC,IAAI,EAAE,CAAC;QAC1C,IAAI,MAAM,GAAG,eAAe,GAAG,CAAC,CAAC;QACjC,MAAM,YAAY,GAAG,uBAAuB,CAAC,IAAI,CAAC,CAAC;QACnD,IAAI,YAAY,IAAI,IAAI,EAAE,CAAC;YACvB,MAAM,GAAG,IAAI,CAAC,GAAG,CAAC,eAAe,EAAE,CAAC,CAAC,GAAG,YAAY,CAAC;QACzD,CAAC;aAAM,CAAC;YACJ,IAAI,IAAA,sBAAY,EAAC,SAAS,CAAC,EAAE,CAAC;gBAC1B,MAAM,eAAe,GAAG,CAAC,CAAC,SAAS,CAAC,aAAa,EAAE,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,eAAe,CAAC,CAAC;gBAC1F,IAAI,eAAe,EAAE,CAAC;oBAClB,MAAM,IAAI,GAAG,MAAA,MAAA,IAAI,CAAC,OAAO,0CAAE,IAAI,mCAAI,IAAI,CAAC;oBACxC,MAAM,GAAG,eAAe,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,eAAe,CAAC,GAAG,IAAI,CAAC,CAAC;gBAC5E,CAAC;YACL,CAAC;YACD,IAAI,IAAA,oBAAU,EAAC,IAAA,yBAAe,EAAC,KAAK,CAAC,IAAI,CAAC,CAAC,EAAE,CAAC;gBAC1C,MAAM,GAAG,eAAe,GAAG,CAAC,CAAC;YACjC,CAAC;QACL,CAAC;QACD,IAAI,cAAc,EAAE,CAAC;YACjB,aAAM,CAAC,KAAK,CACR,GAAG,IAAI,KAAK,KAAK,CAAC,IAAI,CAAC,QAAQ,EAAE,sBAAsB,eAAe,YAAY,MAAM,EAAE,EAC1F,qBAAS,CACZ,CAAC;QACN,CAAC;QACD,OAAO,MAAM,CAAC;IAClB,CAAC,CAAC;AACN,CAAC"}
|
package/lib/src/types.d.ts
CHANGED
|
@@ -1,3 +1,4 @@
|
|
|
1
|
+
import { GraphQLRequestContext } from '@apollo/server';
|
|
1
2
|
import { ComplexityEstimator } from 'graphql-query-complexity';
|
|
2
3
|
/**
|
|
3
4
|
* @description
|
|
@@ -76,4 +77,16 @@ export interface HardenPluginOptions {
|
|
|
76
77
|
* @default 'prod'
|
|
77
78
|
*/
|
|
78
79
|
apiMode?: 'dev' | 'prod';
|
|
80
|
+
/**
|
|
81
|
+
* @description
|
|
82
|
+
* Allows you to skip the complexity check for certain requests.
|
|
83
|
+
*
|
|
84
|
+
* @example
|
|
85
|
+
* ```ts
|
|
86
|
+
* HardenPlugin.init({
|
|
87
|
+
* skip: (context) => context.request.http.headers['x-storefront-ssr-auth'] === 'some-secret-token'
|
|
88
|
+
* }),
|
|
89
|
+
* ```
|
|
90
|
+
*/
|
|
91
|
+
skip?: (context: GraphQLRequestContext<any>) => Promise<boolean> | boolean;
|
|
79
92
|
}
|
package/package.json
CHANGED
|
@@ -1,12 +1,16 @@
|
|
|
1
1
|
{
|
|
2
2
|
"name": "@vendure/harden-plugin",
|
|
3
|
-
"version": "3.1
|
|
3
|
+
"version": "3.2.1",
|
|
4
4
|
"license": "GPL-3.0-or-later",
|
|
5
5
|
"main": "lib/index.js",
|
|
6
6
|
"types": "lib/index.d.ts",
|
|
7
7
|
"files": [
|
|
8
8
|
"lib/**/*"
|
|
9
9
|
],
|
|
10
|
+
"repository": {
|
|
11
|
+
"type": "git",
|
|
12
|
+
"url": "https://github.com/vendure-ecommerce/vendure"
|
|
13
|
+
},
|
|
10
14
|
"scripts": {
|
|
11
15
|
"watch": "tsc -p ./tsconfig.build.json --watch",
|
|
12
16
|
"build": "rimraf lib && tsc -p ./tsconfig.build.json",
|
|
@@ -21,8 +25,8 @@
|
|
|
21
25
|
"graphql-query-complexity": "^0.12.0"
|
|
22
26
|
},
|
|
23
27
|
"devDependencies": {
|
|
24
|
-
"@vendure/common": "^3.1
|
|
25
|
-
"@vendure/core": "^3.1
|
|
28
|
+
"@vendure/common": "^3.2.1",
|
|
29
|
+
"@vendure/core": "^3.2.1"
|
|
26
30
|
},
|
|
27
|
-
"gitHead": "
|
|
31
|
+
"gitHead": "d86ca35d52e64990f5cb17dad476c6315a2e548c"
|
|
28
32
|
}
|