graphql-go / graphql-go/graphql

OverlappingFieldsCanBeMergedRule stack-overflows on cyclic fragment spreads

Open
#742 0 comments 0 reactions 0 assignees View on GitHub
Dominant language
Go
Stars
10.1k
Forks
845
PR merge metrics
No merged PRs in 30d

Description

Validating a document that contains a cyclic fragment spread crashes the process with a stack overflow.

## Reproducer

```graphql
fragment A on Dog { ...B }
fragment B on Dog { ...A }
{ ...A }
```

Running this through `graphql.ValidateDocument` against any schema produces:

```
runtime: goroutine stack exceeds 1000000000-byte limit
fatal error: stack overflow
```

The stack points at `collectConflictsBetweenFieldsAndFragment` in `rules_overlapping_fields_can_be_merged.go` recursing on itself.

## Impact

Any server using this library can be crashed by a small malformed query. `NoFragmentCyclesRule` correctly reports the cycle as a validation error, but `OverlappingFieldsCanBeMergedRule` runs in parallel via the visitor and crashes the process before that result is returned.

## Fix

PR #741 proposes a fix.

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.