graphql-go / graphql-go/graphql
OverlappingFieldsCanBeMergedRule stack-overflows on cyclic fragment spreads
- Dominant language
- Go
- Stars
- 10.1k
- Forks
- 845
- PR merge metrics
- No merged PRs in 30d
Description
Validating a document that contains a cyclic fragment spread crashes the process with a stack overflow.
## Reproducer
```graphql
fragment A on Dog { ...B }
fragment B on Dog { ...A }
{ ...A }
```
Running this through `graphql.ValidateDocument` against any schema produces:
```
runtime: goroutine stack exceeds 1000000000-byte limit
fatal error: stack overflow
```
The stack points at `collectConflictsBetweenFieldsAndFragment` in `rules_overlapping_fields_can_be_merged.go` recursing on itself.
## Impact
Any server using this library can be crashed by a small malformed query. `NoFragmentCyclesRule` correctly reports the cycle as a validation error, but `OverlappingFieldsCanBeMergedRule` runs in parallel via the visitor and crashes the process before that result is returned.
## Fix
PR #741 proposes a fix.
Contributor guide
Assessment
This issue has not been assessed yet.