From ded46774bcda5ff0bed0df62691003265f5fd11b Mon Sep 17 00:00:00 2001
From: Jake Barnby <jakeb994@gmail.com>
Date: Thu, 14 Jul 2022 15:56:02 +1200
Subject: [PATCH] Add max batch size env var

---
 .env                            |  5 +++--
 app/config/variables.php        | 13 +++++++++++--
 app/controllers/api/graphql.php | 20 +++++++++++---------
 3 files changed, 25 insertions(+), 13 deletions(-)

diff --git a/.env b/.env
index fb36abd149..9cf3b72e62 100644
--- a/.env
+++ b/.env
@@ -79,8 +79,9 @@ _APP_USAGE_AGGREGATION_INTERVAL=30
 _APP_USAGE_STATS=enabled
 _APP_LOGGING_PROVIDER=
 _APP_LOGGING_CONFIG=
-_APP_GRAPHQL_MAX_COMPLEXITY=200
-_APP_GRAPHQL_MAX_DEPTH=3
+_APP_GRAPHQL_MAX_BATCH_SIZE=
+_APP_GRAPHQL_MAX_COMPLEXITY=
+_APP_GRAPHQL_MAX_DEPTH=
 DOCKERHUB_PULL_USERNAME=
 DOCKERHUB_PULL_PASSWORD=
 DOCKERHUB_PULL_EMAIL=
\ No newline at end of file
diff --git a/app/config/variables.php b/app/config/variables.php
index 556323ad5c..7243c17a4c 100644
--- a/app/config/variables.php
+++ b/app/config/variables.php
@@ -836,10 +836,19 @@ return [
             'category' => 'GraphQL',
             'description' => '',
             'variables' => [
+                [
+                    'name' => '_APP_GRAPHQL_MAX_BATCH_SIZE',
+                    'description' => 'Maximum number of batched queries per request. The default value is 50.',
+                    'introduction' => '0.17.0',
+                    'default' => '50',
+                    'required' => false,
+                    'question' => '',
+                    'filter' => ''
+                ],
                 [
                     'name' => '_APP_GRAPHQL_MAX_COMPLEXITY',
                     'description' => 'Maximum complexity of a GraphQL query. The default value is 200.',
-                    'introduction' => '0.15.0',
+                    'introduction' => '0.17.0',
                     'default' => '200',
                     'required' => false,
                     'question' => '',
@@ -848,7 +857,7 @@ return [
                 [
                     'name' => '_APP_GRAPHQL_MAX_DEPTH',
                     'description' => 'Maximum depth of a GraphQL query. The default value is 3.',
-                    'introduction' => '0.15.0',
+                    'introduction' => '0.17.0',
                     'default' => '3',
                     'required' => false,
                     'question' => '',
diff --git a/app/controllers/api/graphql.php b/app/controllers/api/graphql.php
index 5666f2dd3c..a8ba817a3b 100644
--- a/app/controllers/api/graphql.php
+++ b/app/controllers/api/graphql.php
@@ -69,32 +69,34 @@ function graphqlRequest(
     Type\Schema $gqlSchema
 ): void {
     $contentType = $request->getHeader('content-type');
+    $maxBatchSize = App::getEnv('_APP_GRAPHQL_MAX_BATCH_SIZE', 50);
+    $maxComplexity = App::getEnv('_APP_GRAPHQL_MAX_QUERY_COMPLEXITY', 200);
+    $maxDepth = App::getEnv('_APP_GRAPHQL_MAX_QUERY_DEPTH', 3);
 
-    if ($contentType === 'application/graphql') {
+    if (\str_starts_with($contentType, 'application/graphql')) {
         $query = parseGraphqlRequest($request);
     }
     if (\str_starts_with($contentType, 'multipart/form-data')) {
         $query = parseMultipartRequest($query, $request);
     }
-    if (!isset($query[0])) {
+    if (!\isset($query[0])) {
         $query = [$query];
     }
-    if (empty($query)) {
+    if (\empty($query)) {
         throw new Exception('No query supplied.', 400, Exception::GRAPHQL_NO_QUERY);
     }
+    if (\count($query) > $maxBatchSize) {
+        throw new Exception('Too many queries in batch.', 400, Exception::GRAPHQL_TOO_MANY_QUERIES);
+    }
 
-    $maxComplexity = App::getEnv('_APP_GRAPHQL_MAX_QUERY_COMPLEXITY', 200);
-    $maxDepth = App::getEnv('_APP_GRAPHQL_MAX_QUERY_DEPTH', 3);
-
+    $debugFlags = DebugFlag::INCLUDE_DEBUG_MESSAGE | DebugFlag::INCLUDE_TRACE;
     $validations = GraphQL::getStandardValidationRules();
     $validations[] = new QueryComplexity($maxComplexity);
     $validations[] = new QueryDepth($maxDepth);
-
+    
     if (App::isProduction()) {
         $validations[] = new DisableIntrospection();
         $debugFlags = DebugFlag::NONE;
-    } else {
-        $debugFlags = DebugFlag::INCLUDE_DEBUG_MESSAGE | DebugFlag::INCLUDE_TRACE;
     }
 
     $promises = [];