graphql-go / graphql / 2014

96%

master: 96%

Build Type

Pull #756

circleci

Committed by ChrisJr404

Commit Message

parser: bound recursion depth to prevent stack exhaustion on deeply nested input

The recursive-descent parser had no limit on nesting depth. A document with
deeply nested list values, object values, selection sets, or list types (for
example "{f(a:[[[[...") drives parseValueLiteral/parseSelectionSet/parseType
into unbounded recursion. On sufficiently nested input this exhausts the
goroutine stack and aborts the process with a fatal "stack overflow", and well
before that the repeated stack growth makes parsing time grow super-linearly.
Since Parse operates on untrusted client-supplied documents, this lets a small
request take down a server.

Track the current nesting depth on the parser and return a syntax error once it
exceeds a fixed limit that is far higher than any realistic document needs.

Pull Request Pull Request #756: parser: bound recursion depth to prevent stack exhaustion on deeply nested input

Coverage Stats

21 of 21 new or added lines in 1 file covered. (100.0%)

1 existing line in 1 file now uncovered.

9360 of 9769 relevant lines covered (95.81%)

2848.07 hits per line