fix: max-depth bypass using fragment cache (#824)

* fix: max-depth bypass using fragment cache

* Create bright-seals-relate.md

Signed-off-by: M0ngi <[email protected]>

* chore: rebase

---------

Signed-off-by: M0ngi <[email protected]>

Author: M0ngi

.changeset/bright-seals-relate.md

@@ -0,0 +1,5 @@
+---
+"@escape.tech/graphql-armor-max-depth": patch
+---
+
+fix: max-depth bypass using fragment cache

packages/plugins/max-depth/src/index.ts

@@ -98,20 +98,20 @@ class MaxDepthVisitor {
         }
       }
     } else if (node.kind == Kind.FRAGMENT_SPREAD) {
+      if (!this.config.flattenFragments) {
+        parentDepth += 1;
+      }
+
       if (this.visitedFragments.has(node.name.value)) {
-        return this.visitedFragments.get(node.name.value) ?? 0;
+        return parentDepth + (this.visitedFragments.get(node.name.value) ?? 0);
       } else {
         this.visitedFragments.set(node.name.value, -1);
       }
       const fragment = this.context.getFragment(node.name.value);
       if (fragment) {
-        let fragmentDepth;
-        if (this.config.flattenFragments) {
-          fragmentDepth = this.countDepth(fragment, parentDepth);
-        } else {
-          fragmentDepth = this.countDepth(fragment, parentDepth + 1);
-        }
-        depth = Math.max(depth, fragmentDepth);
+        let fragmentDepth = this.countDepth(fragment, 0);
+
+        depth = Math.max(depth, parentDepth + fragmentDepth);
         if (this.visitedFragments.get(node.name.value) === -1) {
           this.visitedFragments.set(node.name.value, fragmentDepth);
         }

packages/plugins/max-depth/test/index.spec.ts

@@ -191,7 +191,7 @@ describe('maxDepthPlugin', () => {
     assertSingleExecutionValue(result);
     expect(result.errors).toBeDefined();
     expect(result.errors?.map((error) => error.message)).toContain(
-      'Syntax Error: Query depth limit of 3 exceeded, found 4.',
+      'Syntax Error: Query depth limit of 3 exceeded, found 5.',
     );
   });
 
@@ -269,4 +269,39 @@ describe('maxDepthPlugin', () => {
       `Syntax Error: Query depth limit of ${maxDepth} exceeded, found ${maxDepth + 2}.`,
     ]);
   });
+
+  it('rejects for exceeding max depth by reusing a cached Fragment', async () => {
+    const bypass_query = `
+      query {
+        books {
+          author {
+            ...Test
+          }
+        }
+        books {
+          author {
+            books {
+              author {
+                ...Test
+              }
+            }
+          }
+        }
+      }
+      fragment Test on Author {
+        books {
+          title
+        }
+      }
+    `;
+    const maxDepth = 6;
+    const testkit = createTestkit([maxDepthPlugin({ n: maxDepth, exposeLimits: true })], schema);
+    const result = await testkit.execute(bypass_query);
+
+    assertSingleExecutionValue(result);
+    expect(result.errors).toBeDefined();
+    expect(result.errors?.map((error) => error.message)).toEqual([
+      `Syntax Error: Query depth limit of ${maxDepth} exceeded, found ${maxDepth + 2}.`,
+    ]);
+  });
 });