DataBinder using default auto grow collection limit

[j-kitch]

Hi,

My team has run into an issue with sending GraphQL requests with lists with greater than 256 elements over HTTP. This is occurring when the list is either directly in the query, or sent as a variable.

I think from my investigation that this is due to using the default DataBinder limit DataBinder.DEFAULT_AUTO_GROW_COLLECTION_LIMIT as we simply construct a normal DataBinder instance here:

spring-graphql/spring-graphql/src/main/java/org/springframework/graphql/data/GraphQlArgumentBinder.java

Line 124 in a9e4324

DataBinder binder = new DataBinder(null, argumentName != null ? argumentName : "arguments");

I would have expected a more generous default, the ability to configure the property, or inject a different instance.

This is my first issue I've reported here so apologies if I've made any mistakes or need to change the issue - thanks!

[bclozel]

Thanks for raising this issue!
While we could reuse the ConfigurableWebBindingInitializer from the Spring web support, this is very much web specific. So we'll probably provide a way to consume the DataBinder and configure it on the AnnotatedControllerConfigurer.

On the Spring Boot side, we might create a new configuration property to make things easier to configure.
We should probably also consider setting a higher default, GraphQL being heavily data oriented. @j-kitch do you have a suggestion for a higher, sensible default for this value?

[j-kitch]

Thanks for getting back on this @bclozel

I agree, staying decoupled from the web specific support and allowing consumption of the DataBinder to be configured in AnnotatedControllerConfigurer sounds like the right choice.

For a sensible default - 512 or 1024 seem large enough without allowing developers to shoot themselves in the foot.

[CH-EricLundberg]

How do I actually use this? I don't see anything in the documentation. I've tried setting the dataBinder in various ways to get above 1024 limit but nothing seems to stick. :/

[rstoyanchev]

You can set a Consumer<DataBinder> on AnnotatedControllerConfigurer. Note that this applies only to 1.0.x only. For 1.1, with #516, we no longer use DataBinder and all the logic is in GraphQlArgumentBinder itself.

[CH-EricLundberg]

What is the proper way to get access to the AnnotatedControllerConfigurer to do that? I haven't had to use that before and what I've tried thus far hasn't worked. Thanks for the response, appreciate it.

[CH-EricLundberg]

So I tried:

@Component
class MyAnnotatedControllerConfigurer {

    public MyAnnotatedControllerConfigurer(AnnotatedControllerConfigurer annotatedControllerConfigurer) {
        annotatedControllerConfigurer.setDataBinderInitializer(dataBinder -> dataBinder.setAutoGrowCollectionLimit(20000));
        }
}

which is called, but does not seem to affect the limit. I.e., same error with more than 1024 items.

I did end up working around the issue for better/worse.

My mutation input object is along the lines of:

@Data
@AllArgsConstructor
@NoArgsConstructor
public class MyInput {

    //various fields
    private List<Long> ids;
}

if I remove the @NoArgsConstructor it seems the use the all args constructor and skips the limit checking all together, which will work for us. Unclear why the setting of the dataBinder above wasn't doing the trick, I'm assuming I was doing the databinding setAutoGrow wrong.

[bclozel]

@CH-EricLundberg

In a Spring Boot application, you could replace the bean completely by declaring it in your configuration:

@Bean
public AnnotatedControllerConfigurer annotatedControllerConfigurer() {
  AnnotatedControllerConfigurer configurer = new AnnotatedControllerConfigurer();
  configurer.setDataBinderInitializer(dataBinder -> dataBinder.setAutoGrowCollectionLimit(20000));
  return configurer;
}

I believe that your first attempt was trying to post process an existing bean. You can do that with:

public class AnnotatedControllerConfigurerPostProcessor implements BeanPostProcessor {

   @Override
   public Object postProcessAfterInitialization(Object bean, String beanName) throws BeansException {
   	if (bean instanceof AnnotatedControllerConfigurer configurer) {
   		configurer.setDataBinderInitializer(dataBinder -> dataBinder.setAutoGrowCollectionLimit(20000));
   	}
   	return bean;
   }
}

and then declare that AnnotatedControllerConfigurerPostProcessor as a bean in your application.