Security Test: Character limit¶

Description¶

Default Severity: low

When there's no limit on how long a query can be, an attacker might send a query that’s excessively long to overwhelm the system or trick it into revealing internal details. This is dangerous because it can lead to a denial-of-service where the server struggles to process large requests, or even leak sensitive information if the query parsing exposes insights about the backend. Developers should be careful to impose limits or validations on the query lengths to avoid these issues.

Reference:

• https://shopify.engineering/rate-limiting-graphql-apis-calculating-query-complexity

Configuration¶

Identifier: resource_limitation/character_limit

Examples¶

All configuration available:

checks:
  resource_limitation/character_limit:
    skip: false # default
    options:
      threshold: 15000 # default

Options¶

Options can be set in the options key of the Security Test Configuration.

Compliance and Standards¶