limit stack recursion to 50

Author: imor

src/resolve.rs

@@ -85,7 +85,7 @@ where
         .map(|x| x.0);
 
     for fd in &fragment_defs {
-        match detect_fragment_cycles(fd, &mut HashSet::new(), &fragment_defs) {
+        match detect_fragment_cycles(fd, &mut HashSet::new(), &fragment_defs, 1) {
             Ok(()) => {}
             Err(message) => {
                 return GraphQLResponse {
@@ -516,14 +516,22 @@ where
     }
 }
 
+const STACK_DEPTH_LIMIT: u32 = 50;
+
 fn detect_fragment_cycles<'a, 'b, T>(
     fragment_definition: &'b FragmentDefinition<'a, T>,
     visited: &mut HashSet<&'b str>,
     fragment_definitions: &'b [FragmentDefinition<'a, T>],
+    stack_depth: u32,
 ) -> Result<(), String>
 where
     T: Text<'a>,
 {
+    if stack_depth > STACK_DEPTH_LIMIT {
+        return Err(format!(
+            "Fragment cycle depth is greater than {STACK_DEPTH_LIMIT}"
+        ));
+    }
     if visited.contains(fragment_definition.name.as_ref()) {
         return Err("Found a cycle between fragments".to_string());
     } else {
@@ -533,6 +541,7 @@ where
         &fragment_definition.selection_set,
         visited,
         fragment_definitions,
+        stack_depth + 1,
     )?;
 
     visited.remove(fragment_definition.name.as_ref());
@@ -543,23 +552,30 @@ fn detect_fragment_cycles_in_selection_set<'a, 'b, T>(
     selection_set: &'b SelectionSet<'a, T>,
     visited: &mut HashSet<&'b str>,
     fragment_definitions: &'b [FragmentDefinition<'a, T>],
+    stack_depth: u32,
 ) -> Result<(), String>
 where
     T: Text<'a>,
 {
+    if stack_depth > STACK_DEPTH_LIMIT {
+        return Err(format!(
+            "Fragment cycle depth is greater than {STACK_DEPTH_LIMIT}"
+        ));
+    }
     for selection in &selection_set.items {
         match selection {
             Selection::Field(field) => {
                 detect_fragment_cycles_in_selection_set(
                     &field.selection_set,
                     visited,
                     fragment_definitions,
+                    stack_depth + 1,
                 )?;
             }
             Selection::FragmentSpread(fragment_spread) => {
                 for fd in fragment_definitions {
                     if fd.name == fragment_spread.fragment_name {
-                        detect_fragment_cycles(fd, visited, fragment_definitions)?;
+                        detect_fragment_cycles(fd, visited, fragment_definitions, stack_depth + 1)?;
                         break;
                     }
                 }
@@ -569,6 +585,7 @@ where
                     &inline_fragment.selection_set,
                     visited,
                     fragment_definitions,
+                    stack_depth + 1,
                 )?;
             }
         }

test/expected/issue_fragment_spread_cycles.out

@@ -36,13 +36,13 @@ begin;
     }
     $$);
 
+    -- example from dockerfile
     create table account(
         id serial primary key,
         email varchar(255) not null,
         created_at timestamp not null
     );
 
-
     create table blog(
         id serial primary key,
         owner_id integer not null references account(id) on delete cascade,
@@ -51,10 +51,8 @@ begin;
         created_at timestamp not null
     );
 
-
     create type blog_post_status as enum ('PENDING', 'RELEASED');
 
-
     create table blog_post(
         id uuid not null default gen_random_uuid() primary key,
         blog_id integer not null references blog(id) on delete cascade,
@@ -64,8 +62,6 @@ begin;
         created_at timestamp not null
     );
 
-
-    -- 5 Accounts
     insert into public.account(email, created_at)
     values
         ('aardvark@x.com', now()),
@@ -81,7 +77,6 @@ begin;
         ((select id from account where email ilike 'a%'), 'A: Blog 3', 'a desc3', now()),
         ((select id from account where email ilike 'b%'), 'B: Blog 3', 'b desc1', now());
 
-
     comment on schema public is '@graphql({"inflect_names": true})';
 
     select graphql.resolve($$
@@ -112,4 +107,68 @@ begin;
     }
     $$);
 
+    select graphql.resolve($$
+    {
+        blogCollection {
+            edges {
+                node {
+                    ... blogFragment
+                }
+            }
+        }
+    }
+
+    fragment blogFragment on Blog {
+        owner {
+            blogCollection {
+                edges {
+                    node {
+                        owner {
+                            blogCollection {
+                                edges {
+                                    node {
+                                        owner {
+                                            blogCollection {
+                                                edges {
+                                                    node {
+                                                        owner {
+                                                            blogCollection {
+                                                                edges {
+                                                                    node {
+                                                                        owner {
+                                                                            blogCollection {
+                                                                                edges {
+                                                                                    node {
+                                                                                        owner {
+                                                                                            blogCollection {
+                                                                                                edges {
+                                                                                                    node {
+                                                                                                        id
+                                                                                                    }
+                                                                                                }
+                                                                                            }
+                                                                                        }
+                                                                                    }
+                                                                                }
+                                                                            }
+                                                                        }
+                                                                    }
+                                                                }
+                                                            }
+                                                        }
+                                                    }
+                                                }
+                                            }
+                                        }
+                                    }
+                                }
+                            }
+                        }
+                    }
+                }
+            }
+        }
+    }
+    $$);
+
 rollback;