#3118 Add token limit option to fix CVE-2023-49559 (#3136)

* Use ParseQueryWithLmit and add parserTokenLimit to executor * add parser token limit test * remove failing test * move default token limit to const --------- Co-authored-by: Xavier Godart <[email protected]>
99designs · Jun 13, 2024 · f813598 · f813598
1 parent ee1e18c
commit f813598
Show file tree

Hide file tree

Showing 2 changed files with 19 additions and 6 deletions.
diff --git a/graphql/executor/executor.go b/graphql/executor/executor.go
@@ -12,6 +12,8 @@ import (
 	"github.com/99designs/gqlgen/graphql/errcode"
 )
 
+const parserTokenNoLimit = 0
+
 // Executor executes graphql queries against a schema.
 type Executor struct {
 	es         graphql.ExecutableSchema
@@ -21,6 +23,8 @@ type Executor struct {
 	errorPresenter graphql.ErrorPresenterFunc
 	recoverFunc    graphql.RecoverFunc
 	queryCache     graphql.Cache
+
+	parserTokenLimit int
 }
 
 var _ graphql.GraphExecutor = &Executor{}
@@ -29,11 +33,12 @@ var _ graphql.GraphExecutor = &Executor{}
 // recovery callbacks, and no query cache or extensions.
 func New(es graphql.ExecutableSchema) *Executor {
 	e := &Executor{
-		es:             es,
-		errorPresenter: graphql.DefaultErrorPresenter,
-		recoverFunc:    graphql.DefaultRecover,
-		queryCache:     graphql.NoCache{},
-		ext:            processExtensions(nil),
+		es:               es,
+		errorPresenter:   graphql.DefaultErrorPresenter,
+		recoverFunc:      graphql.DefaultRecover,
+		queryCache:       graphql.NoCache{},
+		ext:              processExtensions(nil),
+		parserTokenLimit: parserTokenNoLimit,
 	}
 	return e
 }
@@ -169,6 +174,10 @@ func (e *Executor) SetRecoverFunc(f graphql.RecoverFunc) {
 	e.recoverFunc = f
 }
 
+func (e *Executor) SetParserTokenLimit(limit int) {
+	e.parserTokenLimit = limit
+}
+
 // parseQuery decodes the incoming query and validates it, pulling from cache if present.
 //
 // NOTE: This should NOT look at variables, they will change per request. It should only parse and
@@ -189,7 +198,7 @@ func (e *Executor) parseQuery(
 		return doc.(*ast.QueryDocument), nil
 	}
 
-	doc, err := parser.ParseQuery(&ast.Source{Input: query})
+	doc, err := parser.ParseQueryWithTokenLimit(&ast.Source{Input: query}, e.parserTokenLimit)
 	if err != nil {
 		gqlErr, ok := err.(*gqlerror.Error)
 		if ok {

diff --git a/graphql/handler/server.go b/graphql/handler/server.go
@@ -67,6 +67,10 @@ func (s *Server) SetQueryCache(cache graphql.Cache) {
 	s.exec.SetQueryCache(cache)
 }
 
+func (s *Server) SetParserTokenLimit(limit int) {
+	s.exec.SetParserTokenLimit(limit)
+}
+
 func (s *Server) Use(extension graphql.HandlerExtension) {
 	s.exec.Use(extension)
 }