fix: add __typename to the default value of allowList

[jczaplew]

Closes #738, supersedes #766

There is a GraphQL vulnerability related to allowing an unlimited number of aliases of __typename - an attacker can craft a query that consists of tens of thousands of aliases, like {"query": "query aliasOverLoad { alias0: __typename alias1: __typename alias2: __typename alias3: __typename alias4: __typename alias5: __typename <...thousands more> }"} and can be a way to bypass authentication on the API because it does not hit any resolvers. With enough simultaneous queries like this it can fairly easily bring down a server.

In #468 the behavior of the max aliases plugin was modified to permanently omit aliases of __typename from the alias count. This PR builds on those changes by setting the default value of allowList to ["__typename"] so that consumers can opt out of this behavior, while maintaining backwards compatibility.

[changeset-bot]

⚠️ No Changeset found

Latest commit: 0b8703c

Merging this PR will not cause a version bump for any packages. If these changes should not result in a new version, you're good to go. If these changes should result in a version bump, you need to add a changeset.

This PR includes no changesets

When changesets are added to this PR, you'll see the packages that this PR includes changesets for and the associated semver types

Click here to learn what changesets are, and how to add one.

Click here if you're a maintainer who wants to add a changeset to this PR