OWASP / OWASP/Nest

Inconsistent validation of GraphQL limit parameters across resolvers

Open
#3,476 1 comment 0 reactions 0 assignees View on GitHub
bug enhancement question
Dominant language
Python
Stars
451
Forks
707
Avg merge
22h 59m
Merged PRs (30d)
91

Description

**Describe the bug**
GraphQL resolvers across the codebase handle the `limit` parameter inconsistently. While a shared `validate_limit` helper exists to enforce safe bounds, many resolvers accept user-provided `limit` values without validation.

This allows negative or excessively large limits to reach the database layer.

---

**To Reproduce**
Steps to reproduce the behavior:

1. Call a GraphQL resolver that accepts a `limit` parameter (e.g. `recent_milestones`, issues, releases).
2. Pass a negative value (e.g. `limit: -1`) or an excessively large value.
3. Execute the query.
4. Observe database errors or heavy query execution.

---

**Expected behavior**
All GraphQL resolvers accepting a `limit` parameter should consistently validate it using a shared utility to ensure safe, bounded values.

---

**Are you going to work on fixing this?**

- [x] Yes
- [ ] No

---

**Screenshots**
Not applicable.

---

**Desktop (please complete the following information):**

- OS: N/A
- Browser: N/A
- Version: N/A

---

**Smartphone (please complete the following information):**

- Device: N/A
- OS: N/A
- Browser: N/A
- Version: N/A

---

**Additional context**
Some resolvers (e.g. `project.py`) already enforce bounds using `min(limit, MAX_LIMIT)` and `> 0` checks, while others do not. Reusing the existing `validate_limit` helper or introducing a shared decorator would ensure consistent behavior across all GraphQL endpoints.

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.