Skip to content

validation: restrict maximum number of errors to 100 by default #3283

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
merged 1 commit into from
Oct 1, 2021
Merged

validation: restrict maximum number of errors to 100 by default #3283

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
10 changes: 8 additions & 2 deletions src/validation/validate.ts
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -28,18 +28,24 @@ import { SDLValidationContext, ValidationContext } from './ValidationContext';
* (see the language/visitor API). Visitor methods are expected to return
* GraphQLErrors, or Arrays of GraphQLErrors when invalid.
*
* Validate will stop validation after a `maxErrors` limit has been reached.
* Attackers can send pathologically invalid queries to induce a DoS attack,
* so by default `maxErrors` set to 100 errors.
*
* Optionally a custom TypeInfo instance may be provided. If not provided, one
* will be created from the provided schema.
*/
export function validate(
schema: GraphQLSchema,
documentAST: DocumentNode,
rules: ReadonlyArray<ValidationRule> = specifiedRules,
options: { maxErrors?: number } = { maxErrors: undefined },
options?: { maxErrors?: number },

/** @deprecated will be removed in 17.0.0 */
typeInfo: TypeInfo = new TypeInfo(schema),
): ReadonlyArray<GraphQLError> {
const maxErrors = options?.maxErrors ?? 100;

devAssert(documentAST, 'Must provide document.');
// If the schema used for validation is invalid, throw an error.
assertValidSchema(schema);
Expand All @@ -51,7 +57,7 @@ export function validate(
documentAST,
typeInfo,
(error) => {
if (options.maxErrors != null && errors.length >= options.maxErrors) {
if (errors.length >= maxErrors) {
errors.push(
new GraphQLError(
'Too many validation errors, error limit reached. Validation aborted.',
Expand Down