Version 4.6.0

2025-12-19 05:55:31 -08:00
1 parent f79dcf067a
commit 517a5e1f70
@@ -1,7 +1,10 @@
 <?php

+declare(strict_types=1);
+
 namespace GraphQL\Validator\Rules;

+use ArrayObject;
 use GraphQL\Error\Error;
 use GraphQL\Executor\Values;
 use GraphQL\Language\AST\FieldNode;
@@ -12,74 +15,53 @@ use GraphQL\Language\AST\NodeKind;
 use GraphQL\Language\AST\OperationDefinitionNode;
 use GraphQL\Language\AST\SelectionSetNode;
 use GraphQL\Language\Visitor;
+use GraphQL\Language\VisitorOperation;
 use GraphQL\Type\Definition\Directive;
 use GraphQL\Type\Definition\FieldDefinition;
 use GraphQL\Validator\ValidationContext;
+use function array_map;
+use function count;
+use function implode;
+use function method_exists;
+use function sprintf;

-class QueryComplexity extends AbstractQuerySecurity
+class QueryComplexity extends QuerySecurityRule
 {
+    /** @var int */
    private $maxQueryComplexity;

+    /** @var mixed[]|null */
    private $rawVariableValues = [];

+    /** @var ArrayObject */
    private $variableDefs;

+    /** @var ArrayObject */
    private $fieldNodeAndDefs;

-    /**
-     * @var ValidationContext
-     */
+    /** @var ValidationContext */
    private $context;

+    /** @var int */
+    private $complexity;
+
    public function __construct($maxQueryComplexity)
    {
        $this->setMaxQueryComplexity($maxQueryComplexity);
    }

-    public static function maxQueryComplexityErrorMessage($max, $count)
-    {
-        return sprintf('Max query complexity should be %d but got %d.', $max, $count);
-    }
-
-    /**
-     * Set max query complexity. If equal to 0 no check is done. Must be greater or equal to 0.
-     *
-     * @param $maxQueryComplexity
-     */
-    public function setMaxQueryComplexity($maxQueryComplexity)
-    {
-        $this->checkIfGreaterOrEqualToZero('maxQueryComplexity', $maxQueryComplexity);
-
-        $this->maxQueryComplexity = (int) $maxQueryComplexity;
-    }
-
-    public function getMaxQueryComplexity()
-    {
-        return $this->maxQueryComplexity;
-    }
-
-    public function setRawVariableValues(array $rawVariableValues = null)
-    {
-        $this->rawVariableValues = $rawVariableValues ?: [];
-    }
-
-    public function getRawVariableValues()
-    {
-        return $this->rawVariableValues;
-    }
-
    public function getVisitor(ValidationContext $context)
    {
        $this->context = $context;

-        $this->variableDefs = new \ArrayObject();
-        $this->fieldNodeAndDefs = new \ArrayObject();
-        $complexity = 0;
+        $this->variableDefs     = new ArrayObject();
+        $this->fieldNodeAndDefs = new ArrayObject();
+        $this->complexity       = 0;

        return $this->invokeIfNeeded(
            $context,
            [
-                NodeKind::SELECTION_SET => function (SelectionSetNode $selectionSet) use ($context) {
+                NodeKind::SELECTION_SET        => function (SelectionSetNode $selectionSet) use ($context) : void {
                    $this->fieldNodeAndDefs = $this->collectFieldASTsAndDefs(
                        $context,
                        $context->getParentType(),
@@ -88,23 +70,31 @@ class QueryComplexity extends AbstractQuerySecurity
                        $this->fieldNodeAndDefs
                    );
                },
-                NodeKind::VARIABLE_DEFINITION => function ($def) {
+                NodeKind::VARIABLE_DEFINITION  => function ($def) : VisitorOperation {
                    $this->variableDefs[] = $def;
+
                    return Visitor::skipNode();
                },
                NodeKind::OPERATION_DEFINITION => [
-                    'leave' => function (OperationDefinitionNode $operationDefinition) use ($context, &$complexity) {
+                    'leave' => function (OperationDefinitionNode $operationDefinition) use ($context, &$complexity) : void {
                        $errors = $context->getErrors();

-                        if (empty($errors)) {
-                            $complexity = $this->fieldComplexity($operationDefinition, $complexity);
-
-                            if ($complexity > $this->getMaxQueryComplexity()) {
-                                $context->reportError(
-                                    new Error($this->maxQueryComplexityErrorMessage($this->getMaxQueryComplexity(), $complexity))
-                                );
-                            }
+                        if (count($errors) > 0) {
+                            return;
                        }
+
+                        $this->complexity = $this->fieldComplexity($operationDefinition, $complexity);
+
+                        if ($this->getQueryComplexity() <= $this->getMaxQueryComplexity()) {
+                            return;
+                        }
+
+                        $context->reportError(
+                            new Error(self::maxQueryComplexityErrorMessage(
+                                $this->getMaxQueryComplexity(),
+                                $this->getQueryComplexity()
+                            ))
+                        );
                    },
                ],
            ]
@@ -124,11 +114,10 @@ class QueryComplexity extends AbstractQuerySecurity

    private function nodeComplexity(Node $node, $complexity = 0)
    {
-        switch ($node->kind) {
-            case NodeKind::FIELD:
-                /* @var FieldNode $node */
+        switch (true) {
+            case $node instanceof FieldNode:
                // default values
-                $args = [];
+                $args         = [];
                $complexityFn = FieldDefinition::DEFAULT_COMPLEXITY_FN;

                // calculate children complexity if needed
@@ -140,7 +129,7 @@ class QueryComplexity extends AbstractQuerySecurity
                }

                $astFieldInfo = $this->astFieldInfo($node);
-                $fieldDef = $astFieldInfo[1];
+                $fieldDef     = $astFieldInfo[1];

                if ($fieldDef instanceof FieldDefinition) {
                    if ($this->directiveExcludesField($node)) {
@@ -154,22 +143,20 @@ class QueryComplexity extends AbstractQuerySecurity
                    }
                }

-                $complexity += call_user_func_array($complexityFn, [$childrenComplexity, $args]);
+                $complexity += $complexityFn($childrenComplexity, $args);
                break;

-            case NodeKind::INLINE_FRAGMENT:
-                /* @var InlineFragmentNode $node */
+            case $node instanceof InlineFragmentNode:
                // node has children?
                if (isset($node->selectionSet)) {
                    $complexity = $this->fieldComplexity($node, $complexity);
                }
                break;

-            case NodeKind::FRAGMENT_SPREAD:
-                /* @var FragmentSpreadNode $node */
+            case $node instanceof FragmentSpreadNode:
                $fragment = $this->getFragment($node);

-                if (null !== $fragment) {
+                if ($fragment !== null) {
                    $complexity = $this->fieldComplexity($fragment, $complexity);
                }
                break;
@@ -180,11 +167,11 @@ class QueryComplexity extends AbstractQuerySecurity

    private function astFieldInfo(FieldNode $field)
    {
-        $fieldName = $this->getFieldName($field);
+        $fieldName    = $this->getFieldName($field);
        $astFieldInfo = [null, null];
        if (isset($this->fieldNodeAndDefs[$fieldName])) {
            foreach ($this->fieldNodeAndDefs[$fieldName] as $astAndDef) {
-                if ($astAndDef[0] == $field) {
+                if ($astAndDef[0] === $field) {
                    $astFieldInfo = $astAndDef;
                    break;
                }
@@ -194,54 +181,120 @@ class QueryComplexity extends AbstractQuerySecurity
        return $astFieldInfo;
    }

+    private function directiveExcludesField(FieldNode $node)
+    {
+        foreach ($node->directives as $directiveNode) {
+            if ($directiveNode->name->value === 'deprecated') {
+                return false;
+            }
+            [$errors, $variableValues] = Values::getVariableValues(
+                $this->context->getSchema(),
+                $this->variableDefs,
+                $this->getRawVariableValues()
+            );
+            if (count($errors ?? []) > 0) {
+                throw new Error(implode(
+                    "\n\n",
+                    array_map(
+                        static function ($error) {
+                            return $error->getMessage();
+                        },
+                        $errors
+                    )
+                ));
+            }
+            if ($directiveNode->name->value === 'include') {
+                $directive = Directive::includeDirective();
+                /** @var bool $directiveArgsIf */
+                $directiveArgsIf = Values::getArgumentValues($directive, $directiveNode, $variableValues)['if'];
+
+                return ! $directiveArgsIf;
+            }
+            if ($directiveNode->name->value === Directive::SKIP_NAME) {
+                $directive = Directive::skipDirective();
+                /** @var bool $directiveArgsIf */
+                $directiveArgsIf = Values::getArgumentValues($directive, $directiveNode, $variableValues)['if'];
+
+                return $directiveArgsIf;
+            }
+        }
+
+        return false;
+    }
+
+    public function getRawVariableValues()
+    {
+        return $this->rawVariableValues;
+    }
+
+    /**
+     * @param mixed[]|null $rawVariableValues
+     */
+    public function setRawVariableValues(?array $rawVariableValues = null)
+    {
+        $this->rawVariableValues = $rawVariableValues ?? [];
+    }
+
    private function buildFieldArguments(FieldNode $node)
    {
        $rawVariableValues = $this->getRawVariableValues();
-        $astFieldInfo = $this->astFieldInfo($node);
-        $fieldDef = $astFieldInfo[1];
+        $astFieldInfo      = $this->astFieldInfo($node);
+        $fieldDef          = $astFieldInfo[1];

        $args = [];

        if ($fieldDef instanceof FieldDefinition) {
-            $variableValues = Values::getVariableValues(
+            [$errors, $variableValues] = Values::getVariableValues(
                $this->context->getSchema(),
                $this->variableDefs,
                $rawVariableValues
            );
+
+            if (count($errors ?? []) > 0) {
+                throw new Error(implode(
+                    "\n\n",
+                    array_map(
+                        static function ($error) {
+                            return $error->getMessage();
+                        },
+                        $errors
+                    )
+                ));
+            }
+
            $args = Values::getArgumentValues($fieldDef, $node, $variableValues);
        }

        return $args;
    }

-    private function directiveExcludesField(FieldNode $node) {
-        foreach ($node->directives as $directiveNode) {
-            if ($directiveNode->name->value === 'deprecated') {
-                return false;
-            }
+    public function getQueryComplexity()
+    {
+        return $this->complexity;
+    }

-            $variableValues = Values::getVariableValues(
-                $this->context->getSchema(),
-                $this->variableDefs,
-                $this->getRawVariableValues()
-            );
+    public function getMaxQueryComplexity()
+    {
+        return $this->maxQueryComplexity;
+    }

-            if ($directiveNode->name->value === 'include') {
-                $directive = Directive::includeDirective();
-                $directiveArgs = Values::getArgumentValues($directive, $directiveNode, $variableValues);
+    /**
+     * Set max query complexity. If equal to 0 no check is done. Must be greater or equal to 0.
+     */
+    public function setMaxQueryComplexity($maxQueryComplexity)
+    {
+        $this->checkIfGreaterOrEqualToZero('maxQueryComplexity', $maxQueryComplexity);

-                return !$directiveArgs['if'];
-            } else {
-                $directive = Directive::skipDirective();
-                $directiveArgs = Values::getArgumentValues($directive, $directiveNode, $variableValues);
+        $this->maxQueryComplexity = (int) $maxQueryComplexity;
+    }

-                return $directiveArgs['if'];
-            }
-        }
+    public static function maxQueryComplexityErrorMessage($max, $count)
+    {
+        return sprintf('Max query complexity should be %d but got %d.', $max, $count);
    }

    protected function isEnabled()
    {
-        return $this->getMaxQueryComplexity() !== static::DISABLED;
+        return $this->getMaxQueryComplexity() !== self::DISABLED;
    }
 }