graphql-go / graphql

96%

master: 96%

LAST BUILD ON BRANCH fix-parser-recursion-depth

branch: fix-parser-recursion-depth

CHANGE BRANCH

x

Reset

• fix-parser-recursion-depth
• 0.4.18
• 1046102779/master
• README-pkg-go-dev-badge-update
• anon-contained-struct
• ast-definitions-unit-tests
• atrniv/fix-cyclic-types
• augustoroman/master
• badge
• bigdrum/edge
• chris_issue_78
• circleci
• clean-up-merge-PR-149
• coerce-float-improvement
• context
• context-example
• contribute-back-section
• custom-marshaler
• custom-scalar-type-example
• cycle-guard
• dep
• enable-go-module
• enum-type-pointers
• errcheck
• examples-concurrent-fields
• examples-http-post
• examples-starwars
• examples-todo
• examples-todo-schema
• executor-tests
• extend-mutation-example
• extensions
• fieldsthunk
• fix-gitter-badge
• fix-multi-byte-comments
• fix-panic-blockstring
• fix-unique-name-nil
• fix/abstract-plan-exponential-blowup
• fix/multi-byte-parse
• fix/support-all-integer-types-in-util-bind
• fix_getting_started_on_readme
• formatted-error-private-original-error
• gofmt-s
• graphql-tag
• housinganywhere/expose-default-resolve-function
• introspection-tests
• issue-724
• issue-726
• issue-731
• issue-issue-731
• kr15h/master
• lbarthonet/default-value-args
• master
• mentat-scripts-1
• mentat-scripts-2
• modify-context
• neglectedvalue/expose-default-resolve-function
• new-error-checks-nil-nodes
• no-dependencies
• nonnull-args-default-value
• original-error-improvements
• panic-handler
• parser-tests
• plan-cache
• printer-tests
• readme
• readme_path_fixes
• resolve-returns-error
• revert-149-fix-parse-hang
• scalar-datetime
• sogko/0.5.0
• sogko/0.6.0
• sogko/experiment-parallel-resolve
• sogko/float64
• sogko/resolve-data-race
• svenschneider/fix-input-object-default-value
• titanous/fix-nil-crashes
• titanous/fix-nil-crashes-rebased
• titanous/fix-parse-hang
• tracing-support
• type-definitions
• types_marshaler_implementation
• union-types-test
• updating-circleci
• v0.4.18
• v0.5.0
• v0.6.0
• v0.7.0
• v0.7.1
• v0.7.2
• v0.7.3
• v0.7.4
• v0.7.5
• v7.1.0
• validator-skipped-tests
• vendor

Build # 2014

Build Type

Pull #756

circleci

Committed by ChrisJr404

Commit Message

parser: bound recursion depth to prevent stack exhaustion on deeply nested input

The recursive-descent parser had no limit on nesting depth. A document with
deeply nested list values, object values, selection sets, or list types (for
example "{f(a:[[[[...") drives parseValueLiteral/parseSelectionSet/parseType
into unbounded recursion. On sufficiently nested input this exhausts the
goroutine stack and aborts the process with a fatal "stack overflow", and well
before that the repeated stack growth makes parsing time grow super-linearly.
Since Parse operates on untrusted client-supplied documents, this lets a small
request take down a server.

Track the current nesting depth on the parser and return a syntax error once it
exceeds a fixed limit that is far higher than any realistic document needs.

Pull Request Pull Request #756: parser: bound recursion depth to prevent stack exhaustion on deeply nested input

Coverage Stats

21 of 21 new or added lines in 1 file covered. (100.0%)

1 existing line in 1 file now uncovered.

9360 of 9769 relevant lines covered (95.81%)

2848.07 hits per line