Inconsistent validation of GraphQL limit parameters across resolvers
- Dominant language
- Python
- Stars
- 451
- Forks
- 707
- Avg merge
- 22h 59m
- Merged PRs (30d)
- 91
Description
**Describe the bug**
GraphQL resolvers across the codebase handle the `limit` parameter inconsistently. While a shared `validate_limit` helper exists to enforce safe bounds, many resolvers accept user-provided `limit` values without validation.
This allows negative or excessively large limits to reach the database layer.
---
**To Reproduce**
Steps to reproduce the behavior:
1. Call a GraphQL resolver that accepts a `limit` parameter (e.g. `recent_milestones`, issues, releases).
2. Pass a negative value (e.g. `limit: -1`) or an excessively large value.
3. Execute the query.
4. Observe database errors or heavy query execution.
---
**Expected behavior**
All GraphQL resolvers accepting a `limit` parameter should consistently validate it using a shared utility to ensure safe, bounded values.
---
**Are you going to work on fixing this?**
- [x] Yes
- [ ] No
---
**Screenshots**
Not applicable.
---
**Desktop (please complete the following information):**
- OS: N/A
- Browser: N/A
- Version: N/A
---
**Smartphone (please complete the following information):**
- Device: N/A
- OS: N/A
- Browser: N/A
- Version: N/A
---
**Additional context**
Some resolvers (e.g. `project.py`) already enforce bounds using `min(limit, MAX_LIMIT)` and `> 0` checks, while others do not. Reusing the existing `validate_limit` helper or introducing a shared decorator would ensure consistent behavior across all GraphQL endpoints.
Contributor guide
Assessment
This issue has not been assessed yet.