Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Apply recursion limit in validation #742

Closed
goto-bus-stop opened this issue Nov 14, 2023 · 1 comment · Fixed by #748
Closed

Apply recursion limit in validation #742

goto-bus-stop opened this issue Nov 14, 2023 · 1 comment · Fixed by #748
Labels
apollo-compiler issues/PRs pertaining to semantic analysis & validation

Comments

@goto-bus-stop
Copy link
Member

The parser has a recursion limit to prevent stack overflows on deeply nested selection sets. Validation has recursion breaks for things that may circularly reference each other. But if you build a chain of thousands of named things that reference each other, you may theoretically be able to cause a stack overflow before the recursion break triggers (before it references back to the original definition).

@goto-bus-stop goto-bus-stop added the apollo-compiler issues/PRs pertaining to semantic analysis & validation label Nov 14, 2023
@qwerdenkerXD
Copy link

You're right, here is it.

goto-bus-stop added a commit that referenced this issue Nov 29, 2023
* chore(compiler): add a failing test for #742

* Add max depth to RecursionStack

* Use the CycleError with path for directive and input object cycles

* Reuse length of `RecursionGuard::seen` set as the current recursion depth

* Add limit when recursively walking selection set

* Add `ValidationOptions` structure to pass in recursion limit

Possibly also a diagnostic limit in the future.

Maybe there would be options that could differ between executable and
schema validation, but not right now

* Revert "Add `ValidationOptions` structure to pass in recursion limit"

This reverts commit 7206c61.

* Hardcode recursion limit

* Add a passing fragment chain test; add directive chain tests; lower recursion limit

* Test input objects

* chglg

* Add an error type for hitting recursion limit

* Track max recursion depth in RecursionStack

* Lower limits: 32 for directives and types, 100 for fragments and selections

* update limit in chglg
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
apollo-compiler issues/PRs pertaining to semantic analysis & validation
Projects
None yet
Development

Successfully merging a pull request may close this issue.

2 participants