graphql-core 3.2.11__tar.gz → 3.2.12__tar.gz

{graphql_core-3.2.11 → graphql_core-3.2.12}/.bumpversion.cfg

@@ -1,5 +1,5 @@
 [bumpversion]
-current_version = 3.2.11
+current_version = 3.2.12
 commit = False
 tag = False
 
@@ -8,8 +8,8 @@ search = version = "{current_version}"
 replace = version = "{new_version}"
 
 [bumpversion:file:docs/conf.py]
-search = version = release = '{current_version}'
-replace = version = release = '{new_version}'
+search = version = release = "{current_version}"
+replace = version = release = "{new_version}"
 
 [bumpversion:file:README.md]
 search = The current version {current_version}

{graphql_core-3.2.11 → graphql_core-3.2.12}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: graphql-core
-Version: 3.2.11
+Version: 3.2.12
 Summary: GraphQL implementation for Python, a port of GraphQL.js, the JavaScript reference implementation for GraphQL.
 Home-page: https://github.com/graphql-python/graphql-core
 Author: Christoph Zwerschke
@@ -50,7 +50,7 @@ a query language for APIs created by Facebook.
 ![Lint Status](https://github.com/graphql-python/graphql-core/actions/workflows/lint.yml/badge.svg)
 [![Code Style](https://img.shields.io/badge/code%20style-black-000000.svg)](https://github.com/ambv/black)
 
-The current version 3.2.11 of GraphQL-core is up-to-date with GraphQL.js version 16.14.1.
+The current version 3.2.12 of GraphQL-core is up-to-date with GraphQL.js version 16.14.2.
 
 An extensive test suite with over 2500 unit tests and 100% coverage comprises a
 replication of the complete test suite of GraphQL.js, making sure this port is

{graphql_core-3.2.11 → graphql_core-3.2.12}/README.md

@@ -10,7 +10,7 @@ a query language for APIs created by Facebook.
 ![Lint Status](https://github.com/graphql-python/graphql-core/actions/workflows/lint.yml/badge.svg)
 [![Code Style](https://img.shields.io/badge/code%20style-black-000000.svg)](https://github.com/ambv/black)
 
-The current version 3.2.11 of GraphQL-core is up-to-date with GraphQL.js version 16.14.1.
+The current version 3.2.12 of GraphQL-core is up-to-date with GraphQL.js version 16.14.2.
 
 An extensive test suite with over 2500 unit tests and 100% coverage comprises a
 replication of the complete test suite of GraphQL.js, making sure this port is

{graphql_core-3.2.11 → graphql_core-3.2.12}/docs/conf.py

@@ -61,7 +61,7 @@ author = "Christoph Zwerschke"
 # The short X.Y version.
 # version = '3.2'
 # The full version, including alpha/beta/rc tags.
-version = release = "3.2.11"
+version = release = "3.2.12"
 
 # The language for content autogenerated by Sphinx. Refer to documentation
 # for a list of supported languages.

{graphql_core-3.2.11 → graphql_core-3.2.12}/pyproject.toml

@@ -1,6 +1,6 @@
 [tool.poetry]
 name = "graphql-core"
-version = "3.2.11"
+version = "3.2.12"
 description = """
 GraphQL-core is a Python port of GraphQL.js,\
  the JavaScript reference implementation for GraphQL."""
@@ -87,5 +87,5 @@ disable = [
 ]
 
 [build-system]
-requires = ["poetry_core>=1,<3", "setuptools>=59,<83"]
+requires = ["poetry_core>=1,<3", "setuptools>=59,<85"]
 build-backend = "poetry.core.masonry.api"

{graphql_core-3.2.11 → graphql_core-3.2.12}/src/graphql/language/parser.py

@@ -1355,18 +1355,33 @@ class Parser:
         return nodes
 
     def advance_lexer(self) -> None:
-        token = self._lexer.advance()
-
-        if token.kind != TokenKind.EOF:
+        """Advance the lexer.
+
+        Counts every token that is consumed toward ``max_tokens``, including the
+        comment tokens that the lexer skips over between the previously focused token
+        and the new one. Comments are read and allocated as ``Token`` objects (and
+        chained into the token list) but are not returned by the lexer, so counting
+        only the returned tokens would let a comment-padded document bypass
+        ``max_tokens`` while still allocating one token per comment.
+        """
+        lexer = self._lexer
+        token = lexer.advance()
+        # Count the comment tokens that were skipped since the previously focused
+        # token. They are the nodes strictly between ``last_token`` and ``token`` in
+        # the token linked-list (the lexer only ever skips comments).
+        skipped = lexer.last_token.next
+        while skipped is not None and skipped is not token:
             self._token_counter += 1
-            max_tokens = self._max_tokens
-            if max_tokens is not None and self._token_counter > max_tokens:
-                raise GraphQLSyntaxError(
-                    self._lexer.source,
-                    token.start,
-                    f"Document contains more than {max_tokens} tokens."
-                    " Parsing aborted.",
-                )
+            skipped = skipped.next
+        if token.kind is not TokenKind.EOF:
+            self._token_counter += 1
+        max_tokens = self._max_tokens
+        if max_tokens is not None and self._token_counter > max_tokens:
+            raise GraphQLSyntaxError(
+                lexer.source,
+                token.start,
+                f"Document contains more than {max_tokens} tokens. Parsing aborted.",
+            )
 
 
 def get_token_desc(token: Token) -> str:

{graphql_core-3.2.11 → graphql_core-3.2.12}/src/graphql/validation/rules/overlapping_fields_can_be_merged.py

@@ -32,7 +32,27 @@ from . import ValidationContext, ValidationRule
 
 MYPY = False
 
-__all__ = ["OverlappingFieldsCanBeMergedRule"]
+__all__ = ["MAX_FIELD_COMPARISONS", "OverlappingFieldsCanBeMergedRule"]
+
+# The maximum number of pairwise field comparisons performed while validating a
+# single document with the OverlappingFieldsCanBeMerged rule. The rule compares
+# every pair of fields that share a response name and recurses into their
+# sub-selections, which is O(n^2) in the number of such fields (and worse when
+# inline fragments repeat the same response name at multiple nesting levels). A
+# crafted query can therefore drive validation into minutes of CPU on a single
+# request. Once this many comparisons have been made, validation is aborted with a
+# GraphQLError instead of running to completion. The default is high enough that any
+# realistic query stays far below it; it can be raised or lowered by assigning to
+# ``graphql.validation.rules.overlapping_fields_can_be_merged.MAX_FIELD_COMPARISONS``.
+MAX_FIELD_COMPARISONS = 250_000
+
+
+class ComparisonBudgetExceededError(Exception):
+    """Internal signal that the field-comparison budget has been exhausted.
+
+    Raised deep inside the recursive conflict search and caught by the rule to abort
+    validation. Never surfaces to callers of ``validate``.
+    """
 
 
 def reason_message(reason: "ConflictReasonMessage") -> str:
@@ -67,15 +87,33 @@ class OverlappingFieldsCanBeMergedRule(ValidationRule):
         # times, so this improves the performance of this validator.
         self.cached_fields_and_fragment_names: Dict = {}
 
+        # Set once the comparison budget is exhausted. Further selection sets are then
+        # skipped, since validation has already been aborted with an error.
+        self._budget_exceeded = False
+
     def enter_selection_set(self, selection_set: SelectionSetNode, *_args: Any) -> None:
-        conflicts = find_conflicts_within_selection_set(
-            self.context,
-            self.cached_fields_and_fragment_names,
-            self.compared_fields_and_fragment_pairs,
-            self.compared_fragment_pairs,
-            self.context.get_parent_type(),
-            selection_set,
-        )
+        if self._budget_exceeded:
+            return
+        try:
+            conflicts = find_conflicts_within_selection_set(
+                self.context,
+                self.cached_fields_and_fragment_names,
+                self.compared_fields_and_fragment_pairs,
+                self.compared_fragment_pairs,
+                self.context.get_parent_type(),
+                selection_set,
+            )
+        except ComparisonBudgetExceededError:
+            self._budget_exceeded = True
+            self.report_error(
+                GraphQLError(
+                    "Query is too complex to validate for overlapping fields:"
+                    f" exceeded {MAX_FIELD_COMPARISONS} field comparisons."
+                    " Validation was aborted.",
+                    selection_set,
+                )
+            )
+            return
         for (reason_name, reason), fields1, fields2 in conflicts:
             reason_msg = reason_message(reason)
             self.report_error(
@@ -544,6 +582,12 @@ def find_conflict(
     Determines if there is a conflict between two particular fields, including comparing
     their sub-fields.
     """
+    # Charge this comparison against the document-wide budget and abort validation once
+    # it is exhausted, guarding against quadratic-blowup denial of service.
+    compared_fields_and_fragment_pairs.comparisons += 1
+    if compared_fields_and_fragment_pairs.comparisons > MAX_FIELD_COMPARISONS:
+        raise ComparisonBudgetExceededError
+
     parent_type1, node1, def1 = field1
     parent_type2, node2, def2 = field2
 
@@ -780,14 +824,19 @@ class OrderedPairSet:
 
     The first element is matched by object identity (its ``id``), since field maps
     are unhashable mappings that are kept alive for the duration of the validation.
+
+    Also carries a running count of the pairwise field comparisons performed with
+    this set, used to enforce the OverlappingFieldsCanBeMerged comparison budget.
     """
 
-    __slots__ = ("_data",)
+    __slots__ = ("_data", "comparisons")
 
     _data: Dict[int, Dict[str, bool]]
+    comparisons: int
 
     def __init__(self) -> None:
         self._data = {}
+        self.comparisons = 0
 
     def has(self, a: NodeAndDefCollection, b: str, weakly_present: bool) -> bool:
         map_ = self._data.get(id(a))

{graphql_core-3.2.11 → graphql_core-3.2.12}/src/graphql/version.py

@@ -4,9 +4,9 @@ from typing import NamedTuple
 __all__ = ["version", "version_info", "version_js", "version_info_js"]
 
 
-version = "3.2.11"
+version = "3.2.12"
 
-version_js = "16.14.1"
+version_js = "16.14.2"
 
 
 _re_version = re.compile(r"(\d+)\.(\d+)\.(\d+)(\D*)(\d*)")

{graphql_core-3.2.11 → graphql_core-3.2.12}/src/graphql_core.egg-info/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: graphql-core
-Version: 3.2.11
+Version: 3.2.12
 Summary: GraphQL implementation for Python, a port of GraphQL.js, the JavaScript reference implementation for GraphQL.
 Home-page: https://github.com/graphql-python/graphql-core
 Author: Christoph Zwerschke
@@ -50,7 +50,7 @@ a query language for APIs created by Facebook.
 ![Lint Status](https://github.com/graphql-python/graphql-core/actions/workflows/lint.yml/badge.svg)
 [![Code Style](https://img.shields.io/badge/code%20style-black-000000.svg)](https://github.com/ambv/black)
 
-The current version 3.2.11 of GraphQL-core is up-to-date with GraphQL.js version 16.14.1.
+The current version 3.2.12 of GraphQL-core is up-to-date with GraphQL.js version 16.14.2.
 
 An extensive test suite with over 2500 unit tests and 100% coverage comprises a
 replication of the complete test suite of GraphQL.js, making sure this port is

{graphql_core-3.2.11 → graphql_core-3.2.12}/tests/execution/test_abstract.py

@@ -1,5 +1,5 @@
 from inspect import isawaitable
-from typing import Any, NamedTuple, Optional
+from typing import Any, Callable, NamedTuple, Optional
 
 from pytest import mark
 
@@ -49,6 +49,7 @@ async def execute_query(
 
 def get_is_type_of(type_, sync=True):
     """Get a sync or async is_type_of function for the given type."""
+    is_type_of: Callable[[Any, Any], Any]
     if sync:
 
         def is_type_of(obj, _info):
@@ -65,6 +66,7 @@ def get_is_type_of(type_, sync=True):
 def get_type_error(sync=True):
     """Get a sync or async is_type_of or type resolver function that raises an error."""
     error = RuntimeError("We are testing this error")
+    type_error: Callable[..., Any]
     if sync:
 
         def type_error(*_args):

{graphql_core-3.2.11 → graphql_core-3.2.12}/tests/language/test_parser.py

@@ -116,6 +116,35 @@ def describe_parser():
         ):
             assert parse('{ foo(bar: "baz") }', max_tokens=7)
 
+    def counts_comment_tokens_towards_the_maximum():
+        # Comment tokens are read and allocated by the lexer but skipped over; they
+        # must still count towards max_tokens, otherwise a comment-padded document
+        # bypasses the limit (memory-exhaustion DoS) while allocating one token per
+        # comment. token_count reflects the comments too.
+        assert parse("{ # comment\n foo }").token_count == 4
+        assert parse("# leading\n{ foo }\n# trailing").token_count == 5
+
+        # An interspersed comment pushes the document over the limit.
+        parse("{ # c\n foo }", max_tokens=4)
+        with raises(
+            GraphQLSyntaxError,
+            match="Syntax Error:"
+            r" Document contains more than 3 tokens\. Parsing aborted\.",
+        ):
+            parse("{ # c\n foo }", max_tokens=3)
+
+        # Neither leading nor trailing comment padding can bypass the limit.
+        with raises(
+            GraphQLSyntaxError,
+            match=r"Document contains more than 5 tokens\. Parsing aborted\.",
+        ):
+            parse("# c\n" * 1000 + "{ a }", max_tokens=5)
+        with raises(
+            GraphQLSyntaxError,
+            match=r"Document contains more than 5 tokens\. Parsing aborted\.",
+        ):
+            parse("{ a }" + "\n# c" * 1000, max_tokens=5)
+
     def parses_variable_inline_values():
         parse("{ field(complex: { a: { b: [ $var ] } }) }")
 

{graphql_core-3.2.11 → graphql_core-3.2.12}/tests/validation/test_overlapping_fields_can_be_merged.py

@@ -1,7 +1,11 @@
+from contextlib import contextmanager
 from functools import partial
 
 from graphql.utilities import build_schema
 from graphql.validation import OverlappingFieldsCanBeMergedRule
+from graphql.validation.rules import (
+    overlapping_fields_can_be_merged as overlapping_module,
+)
 
 from .harness import assert_validation_errors
 
@@ -9,6 +13,30 @@ assert_errors = partial(assert_validation_errors, OverlappingFieldsCanBeMergedRu
 
 assert_valid = partial(assert_errors, errors=[])
 
+budget_schema = build_schema("""
+    type Query {
+      field: Node
+      other: Node
+    }
+
+    type Node {
+      f: Node
+      x: String
+    }
+    """)
+
+
+@contextmanager
+def budget_of(limit):
+    # Temporarily lower the module-level comparison budget so the budget tests can
+    # trigger the guard with small, fast queries.
+    saved = overlapping_module.MAX_FIELD_COMPARISONS
+    overlapping_module.MAX_FIELD_COMPARISONS = limit
+    try:
+        yield
+    finally:
+        overlapping_module.MAX_FIELD_COMPARISONS = saved
+
 
 def describe_validate_overlapping_fields_can_be_merged():
     def unique_fields():
@@ -1193,3 +1221,66 @@ def describe_validate_overlapping_fields_can_be_merged():
               }
             }
             """)
+
+    def describe_comparison_budget():
+        def aborts_validation_when_the_comparison_budget_is_exceeded():
+            # Repeated inline fragments select the same response name, forcing O(n^2)
+            # pairwise comparisons. Once the budget is exhausted the rule aborts with
+            # a single error instead of running the comparison to completion. The
+            # trailing `other` selection set is visited after the abort and must be
+            # skipped, so exactly one error is reported for the whole document.
+            query = (
+                "{ field { " + " ".join(["... on Node { x }"] * 10) + " } other { x } }"
+            )
+            with budget_of(5):
+                assert_errors(
+                    query,
+                    [
+                        {
+                            "message": "Query is too complex to validate for"
+                            " overlapping fields: exceeded 5 field comparisons."
+                            " Validation was aborted."
+                        }
+                    ],
+                    schema=budget_schema,
+                )
+
+        def deduplication_alone_would_not_bound_this_query():
+            # Each `f` selection shares the response name `f` but wraps a distinct
+            # sub-selection (`a0: x`, `a1: x`, ...), so every field has a distinct
+            # structural fingerprint and none conflicts with another (differing
+            # aliases merge cleanly). A fix based purely on deduplicating structurally
+            # identical fields cannot remove any of these, so it would still perform
+            # O(n^2) comparisons; the comparison budget bounds the work regardless.
+            query = (
+                "{ field { "
+                + " ".join(f"... on Node {{ f {{ a{i}: x }} }}" for i in range(20))
+                + " } }"
+            )
+            # With a generous budget the query is valid, proving the fields do not
+            # conflict and that no deduplication pass could collapse them.
+            with budget_of(1_000_000):
+                assert_valid(query, schema=budget_schema)
+            # With a small budget the same query is aborted rather than validated in
+            # quadratic time.
+            with budget_of(10):
+                assert_errors(
+                    query,
+                    [
+                        {
+                            "message": "Query is too complex to validate for"
+                            " overlapping fields: exceeded 10 field comparisons."
+                            " Validation was aborted."
+                        }
+                    ],
+                    schema=budget_schema,
+                )
+
+        def does_not_abort_queries_that_stay_within_the_budget():
+            # A valid overlapping query well under the budget validates normally, with
+            # no spurious abort error.
+            with budget_of(50):
+                assert_valid(
+                    "{ field { ... on Node { x } ... on Node { x } } }",
+                    schema=budget_schema,
+                )

{graphql_core-3.2.11 → graphql_core-3.2.12}/tox.ini

@@ -33,8 +33,8 @@ commands =
 [testenv:mypy]
 basepython = python3.14
 deps =
-    mypy>=2.1,<3
-    pytest>=8.4,<9
+    mypy>=2.3,<3
+    pytest>=8.4,<10
 commands =
     mypy src tests
 
@@ -54,8 +54,8 @@ commands =
 
 [testenv]
 deps =
-    pytest>=7.4,<9
-    pytest-asyncio>=0.21,<1
+    pytest>=7.4,<10
+    pytest-asyncio>=0.21,<2
     pytest-benchmark>=4.0,<6
     pytest-cov>=4.1,<8
     pytest-describe>=2,<4