Skip to content

Instantly share code, notes, and snippets.

@stevehenderson
Created July 29, 2022 00:45
Show Gist options
  • Star 0 You must be signed in to star a gist
  • Fork 0 You must be signed in to fork a gist
  • Save stevehenderson/8329ca70e1e90c06ee5adea9b4db52f4 to your computer and use it in GitHub Desktop.
Save stevehenderson/8329ca70e1e90c06ee5adea9b4db52f4 to your computer and use it in GitHub Desktop.
Patch pg-graphql 30 row limit (pg_graphql--0.3.3.sql)
diff --git a/pg_graphql--0.3.3.sql b/pg_graphql--0.3.3.sql
index 1c7e735..c35ca13 100644
--- a/pg_graphql--0.3.3.sql
+++ b/pg_graphql--0.3.3.sql
@@ -3226,19 +3226,19 @@ begin
order by
%s
limit
- least(%s, 30) + 1
+ least(%s, 150) + 1
),
xyz as (
select
*,
- max(%I.__page_row_num_for_page_size) over () > least(%s, 30) as __has_next_page,
+ max(%I.__page_row_num_for_page_size) over () > least(%s, 150) as __has_next_page,
row_number() over () as __page_row_num
from
xyz_maybe_extra as %I
order by
%s
limit
- least(%s, 30)
+ least(%s, 150)
)
select
jsonb_build_object(%s)
@@ -3328,11 +3328,11 @@ begin
end
),
-- limit
- coalesce(first_, last_, '30'),
+ coalesce(first_, last_, '150'),
-- has_next_page block namex
block_name,
-- xyz_has_next_page limit
- coalesce(first_, last_, '30'),
+ coalesce(first_, last_, '150'),
-- xyz
block_name,
graphql.order_by_clause(
@@ -3342,7 +3342,7 @@ begin
else column_orders
end
),
- coalesce(first_, last_, '30'),
+ coalesce(first_, last_, '150'),
-- JSON selects
concat_ws(', ', total
@stevehenderson
Copy link
Author

stevehenderson commented Jul 29, 2022

Warning: setting the row limit too high exposes you to DDOS attacks as malicious actors / user can grind your database

Installation:

Copy the patch above to the pg_graphql install folder.

cd pg_graphql
git apply pg_graphql_150.patch

Then rebuild the extension

sudo make instsll

Then in your database client or psql:

drop extension if exists pg_graphql;
create extension if not exists pg_graphql;

(wait 15-30sec for reload)

@stevehenderson
Copy link
Author

pg 0.4.0

diff --git a/pg_graphql--0.4.0.sql b/pg_graphql--0.4.0.sql
index e983e0f..ad9da04 100644
--- a/pg_graphql--0.4.0.sql
+++ b/pg_graphql--0.4.0.sql
@@ -3138,19 +3138,19 @@ begin
             order by
                 %s
             limit
-                least(%s, 30) + 1
+                least(%s, 150) + 1
         ),
         xyz as (
             select
                 *,
-                max(%I.__page_row_num_for_page_size) over () > least(%s, 30) as __has_next_page,
+                max(%I.__page_row_num_for_page_size) over () > least(%s, 2048) as __has_next_page,
                 row_number() over () as __page_row_num
             from
                 xyz_maybe_extra as %I
             order by
                 %s
             limit
-                least(%s, 30)
+                least(%s, 150)
         )
         select
             jsonb_build_object(%s)
@@ -3240,11 +3240,11 @@ begin
                 end
             ),
             -- limit
-            coalesce(first_, last_, '30'),
+            coalesce(first_, last_, '150'),
             -- has_next_page block namex
             block_name,
             -- xyz_has_next_page limit
-            coalesce(first_, last_, '30'),
+            coalesce(first_, last_, '150'),
             -- xyz
             block_name,
             graphql.order_by_clause(
@@ -3254,7 +3254,7 @@ begin
                     else column_orders
                 end
             ),
-            coalesce(first_, last_, '30'),
+            coalesce(first_, last_, '150'),
             -- JSON selects
             concat_ws(', ', total_count_clause, page_info_clause, __typename_clause, edges_clause),
             -- final order by

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment