Bound GraphQL request cost to prevent alias-flooding DoS

The GraphQL endpoint built its gqlgen server with bare handler.New and
no limits, so a single request with thousands of aliased resolver calls
was parsed, validated, executed, and marshalled in full. Under load this
let an unauthenticated client drive excessive CPU and memory use against
POST /api/connect/v1/graphql and the console and trust endpoints, which
share the same constructor (GHSA-prh2-g8pv-m7p9).

Add configurable guards in the shared gqlutils.NewHandler: a parser
token limit rejects oversized queries at lex time before any execution,
a fixed complexity limit caps field-selection count, an LRU query cache
avoids repeated parsing, and field suggestions are disabled. The limits
flow from a new APIConfig.GraphQL section through server and api config
into all three GraphQL handlers, with PROBOD_API_GRAPHQL_* env vars and
Helm values exposed for per-environment tuning.

Defaults are sized with generous headroom over real traffic: the parser
token limit (15000) and complexity limit (2000) sit far above the
largest legitimate frontend query yet well below the proof-of-concept
flood, so normal usage is unaffected while floods are rejected cheaply.

Signed-off-by: Bryan Frimin <bryan@probo.com>

contrib/helm/charts/probo/templates/deployment.yaml

@@ -75,6 +75,14 @@ spec:
               value: ":{{ .Values.service.port }}"
             - name: PROBOD_API_CORS_ALLOWED_ORIGINS
               value: {{ join "," .Values.probo.cors.allowedOrigins | quote }}
+            - name: PROBOD_API_GRAPHQL_PARSER_TOKEN_LIMIT
+              value: {{ .Values.probo.graphql.parserTokenLimit | quote }}
+            - name: PROBOD_API_GRAPHQL_COMPLEXITY_LIMIT
+              value: {{ .Values.probo.graphql.complexityLimit | quote }}
+            - name: PROBOD_API_GRAPHQL_QUERY_CACHE_SIZE
+              value: {{ .Values.probo.graphql.queryCacheSize | quote }}
+            - name: PROBOD_API_GRAPHQL_DISABLE_SUGGESTION
+              value: {{ .Values.probo.graphql.disableSuggestion | quote }}
             # PostgreSQL Database
             - name: PROBOD_PG_ADDR
               value: {{ printf "%s:%v" (include "probo.postgresql.host" .) (include "probo.postgresql.port" .) | quote }}

contrib/helm/charts/probo/values-production.yaml.example

@@ -111,6 +111,15 @@ probo:
     allowedOrigins:
       - "https://probo.example.com"
 
+  # GraphQL request-cost guards (application-layer DoS protection).
+  # Defaults are production-safe; tune only if a legitimate query is rejected
+  # or to enable complexity analysis. A value of 0 disables the guard.
+  graphql:
+    parserTokenLimit: 15000
+    complexityLimit: 2000
+    queryCacheSize: 1000
+    disableSuggestion: true
+
   # Extra HTTP headers to add to responses
   extraHeaderFields: {}
     # X-Custom-Header: "custom-value"

contrib/helm/charts/probo/values.yaml

@@ -201,6 +201,20 @@ probo:
       - "https://probo.example.com"
       - "http://probo.example.com"
 
+  # GraphQL request-cost guards (application-layer DoS protection).
+  # A value of 0 disables the corresponding guard.
+  graphql:
+    # Maximum number of lexer tokens accepted per query. Oversized queries
+    # (e.g. alias flooding) are rejected at parse time before execution.
+    parserTokenLimit: 15000
+    # Maximum query complexity (field-selection count). 0 disables complexity
+    # analysis.
+    complexityLimit: 2000
+    # Size of the LRU cache of parsed query documents.
+    queryCacheSize: 1000
+    # Disable field suggestions on invalid queries.
+    disableSuggestion: true
+
   # Show Probo branding
   branding: true