Add depth limit to GraphQL parser (#9531)

michaelstaib · web-flow · commit 08c0caa42ca3 · 2026-04-11T00:52:05.000+08:00
diff --git a/src/HotChocolate/Core/src/Execution/DependencyInjection/RequestExecutorServiceCollectionExtensions.cs b/src/HotChocolate/Core/src/Execution/DependencyInjection/RequestExecutorServiceCollectionExtensions.cs
@@ -91,9 +91,12 @@ public static IServiceCollection AddGraphQLCore(this IServiceCollection services
 
                 return new ParserOptions(
                     noLocations: !options.IncludeLocations,
+                    allowFragmentVariables: false,
                     maxAllowedNodes: options.MaxAllowedNodes,
                     maxAllowedTokens: options.MaxAllowedTokens,
-                    maxAllowedFields: options.MaxAllowedFields);
+                    maxAllowedFields: options.MaxAllowedFields,
+                    maxAllowedDirectives: options.MaxAllowedDirectives,
+                    maxAllowedRecursionDepth: options.MaxAllowedRecursionDepth);
             });
 
         return services;
diff --git a/src/HotChocolate/Core/src/Execution/Options/RequestParserOptions.cs b/src/HotChocolate/Core/src/Execution/Options/RequestParserOptions.cs
@@ -50,4 +50,17 @@ public sealed class RequestParserOptions
     /// as fields is an easier way to estimate query size for GraphQL requests.
     /// </summary>
     public int MaxAllowedFields { get; set; } = 2048;
+
+    /// <summary>
+    /// The maximum number of directives allowed per location (e.g. per field,
+    /// per operation, per fragment definition). Repeatable directives can be used
+    /// to exhaust CPU and memory resources if not limited.
+    /// </summary>
+    public int MaxAllowedDirectives { get; set; } = 4;
+
+    /// <summary>
+    /// The maximum allowed recursion depth when parsing a document.
+    /// This prevents stack overflow from deeply nested queries.
+    /// </summary>
+    public int MaxAllowedRecursionDepth { get; set; } = 200;
 }
diff --git a/src/HotChocolate/Language/src/Language.Utf8/ParserOptions.cs b/src/HotChocolate/Language/src/Language.Utf8/ParserOptions.cs
@@ -42,6 +42,29 @@ public ParserOptions(
         MaxAllowedTokens = maxAllowedTokens;
         MaxAllowedNodes = maxAllowedNodes;
         MaxAllowedFields = maxAllowedFields;
+        MaxAllowedDirectives = 4;
+        MaxAllowedRecursionDepth = 200;
+    }
+
+    /// <summary>
+    /// Initializes a new instance of <see cref="ParserOptions"/> with security limits.
+    /// </summary>
+    public ParserOptions(
+        bool noLocations,
+        bool allowFragmentVariables,
+        int maxAllowedNodes,
+        int maxAllowedTokens,
+        int maxAllowedFields,
+        int maxAllowedDirectives,
+        int maxAllowedRecursionDepth)
+    {
+        NoLocations = noLocations;
+        Experimental = new(allowFragmentVariables);
+        MaxAllowedTokens = maxAllowedTokens;
+        MaxAllowedNodes = maxAllowedNodes;
+        MaxAllowedFields = maxAllowedFields;
+        MaxAllowedDirectives = maxAllowedDirectives;
+        MaxAllowedRecursionDepth = maxAllowedRecursionDepth;
     }
 
     /// <summary>
@@ -83,6 +106,18 @@ public ParserOptions(
     /// </summary>
     public int MaxAllowedFields { get; }
 
+    /// <summary>
+    /// The maximum number of directives allowed per location (e.g. per field,
+    /// per operation, per fragment definition). Repeatable directives can be used
+    /// to exhaust CPU and memory resources if not limited.
+    /// </summary>
+    public int MaxAllowedDirectives { get; }
+
+    /// <summary>
+    /// Gets the maximum allowed recursion depth of a parsed document.
+    /// </summary>
+    public int MaxAllowedRecursionDepth { get; }
+
     /// <summary>
     /// Gets the experimental parser options
     /// which are by default switched of.
diff --git a/src/HotChocolate/Language/src/Language.Utf8/Properties/LangUtf8Resources.Designer.cs b/src/HotChocolate/Language/src/Language.Utf8/Properties/LangUtf8Resources.Designer.cs
diff --git a/src/HotChocolate/Language/src/Language.Utf8/Properties/LangUtf8Resources.resx b/src/HotChocolate/Language/src/Language.Utf8/Properties/LangUtf8Resources.resx
@@ -204,4 +204,10 @@
   <data name="Utf8GraphQLParser_Start_MaxAllowedFieldsReached" xml:space="preserve">
     <value>The GraphQL request document contains more than {0} fields. Parsing aborted.</value>
   </data>
+  <data name="Utf8GraphQLParser_ParseDirective_MaxAllowedDirectivesReached" xml:space="preserve">
+    <value>A location in the GraphQL document contains more than {0} directives. Parsing aborted.</value>
+  </data>
+  <data name="Utf8GraphQLParser_Start_MaxAllowedRecursionDepthReached" xml:space="preserve">
+    <value>Document exceeds the maximum allowed recursion depth of {0}. Parsing aborted.</value>
+  </data>
 </root>
diff --git a/src/HotChocolate/Language/src/Language.Utf8/Utf8GraphQLParser.Directives.cs b/src/HotChocolate/Language/src/Language.Utf8/Utf8GraphQLParser.Directives.cs
@@ -1,5 +1,6 @@
 using System.Collections.Generic;
 using System.Runtime.CompilerServices;
+using static HotChocolate.Language.Properties.LangUtf8Resources;
 
 namespace HotChocolate.Language;
 
@@ -65,7 +66,7 @@ private NameNode ParseDirectiveLocation()
         throw Unexpected(kind);
     }
 
-    private List<DirectiveNode> ParseDirectives(bool isConstant)
+    private List<DirectiveNode> ParseDirectives(bool isConstant, bool isQueryLocation = false)
     {
         if (_reader.Kind == TokenKind.At)
         {
@@ -74,6 +75,15 @@ private List<DirectiveNode> ParseDirectives(bool isConstant)
             while (_reader.Kind == TokenKind.At)
             {
                 list.Add(ParseDirective(isConstant));
+
+                if (isQueryLocation && list.Count > _maxAllowedDirectives)
+                {
+                    throw new SyntaxException(
+                        _reader,
+                        string.Format(
+                            Utf8GraphQLParser_ParseDirective_MaxAllowedDirectivesReached,
+                            _maxAllowedDirectives));
+                }
             }
 
             return list;
diff --git a/src/HotChocolate/Language/src/Language.Utf8/Utf8GraphQLParser.Fragments.cs b/src/HotChocolate/Language/src/Language.Utf8/Utf8GraphQLParser.Fragments.cs
@@ -55,7 +55,7 @@ private FragmentDefinitionNode ParseFragmentDefinition()
               ParseVariableDefinitions();
             ExpectOnKeyword();
             var typeCondition = ParseNamedType();
-            var directives = ParseDirectives(false);
+            var directives = ParseDirectives(false, isQueryLocation: true);
             var selectionSet = ParseSelectionSet();
             var location = CreateLocation(in start);
 
@@ -74,7 +74,7 @@ private FragmentDefinitionNode ParseFragmentDefinition()
             var name = ParseFragmentName();
             ExpectOnKeyword();
             var typeCondition = ParseNamedType();
-            var directives = ParseDirectives(false);
+            var directives = ParseDirectives(false, isQueryLocation: true);
             var selectionSet = ParseSelectionSet();
             var location = CreateLocation(in start);
 
@@ -101,7 +101,7 @@ private FragmentDefinitionNode ParseFragmentDefinition()
     private FragmentSpreadNode ParseFragmentSpread(in TokenInfo start)
     {
         var name = ParseFragmentName();
-        var directives = ParseDirectives(false);
+        var directives = ParseDirectives(false, isQueryLocation: true);
         var location = CreateLocation(in start);
 
         return new FragmentSpreadNode
@@ -127,7 +127,7 @@ private InlineFragmentNode ParseInlineFragment(
         in TokenInfo start,
         NamedTypeNode? typeCondition)
     {
-        var directives = ParseDirectives(false);
+        var directives = ParseDirectives(false, isQueryLocation: true);
         var selectionSet = ParseSelectionSet();
         var location = CreateLocation(in start);
 
diff --git a/src/HotChocolate/Language/src/Language.Utf8/Utf8GraphQLParser.Operations.cs b/src/HotChocolate/Language/src/Language.Utf8/Utf8GraphQLParser.Operations.cs
@@ -23,7 +23,7 @@ private OperationDefinitionNode ParseOperationDefinition()
         var operation = ParseOperationType();
         var name = _reader.Kind == TokenKind.Name ? ParseName() : null;
         var variableDefinitions = ParseVariableDefinitions();
-        var directives = ParseDirectives(false);
+        var directives = ParseDirectives(false, isQueryLocation: true);
         var selectionSet = ParseSelectionSet();
         var location = CreateLocation(in start);
 
@@ -133,7 +133,7 @@ private VariableDefinitionNode ParseVariableDefinition()
             ? ParseValueLiteral(true)
             : null;
         var directives =
-            ParseDirectives(true);
+            ParseDirectives(isConstant: true, isQueryLocation: true);
 
         var location = CreateLocation(in start);
 
@@ -173,6 +173,7 @@ private VariableNode ParseVariable()
     /// </summary>
     private SelectionSetNode ParseSelectionSet()
     {
+        IncreaseDepth();
         var start = Start();
 
         if (_reader.Kind != TokenKind.LeftBrace)
@@ -200,6 +201,7 @@ private SelectionSetNode ParseSelectionSet()
 
         var location = CreateLocation(in start);
 
+        DecreaseDepth();
         return new SelectionSetNode
         (
             location,
@@ -252,7 +254,7 @@ private FieldNode ParseField()
 
         var arguments = ParseArguments(false);
         var required = ParseRequiredStatus();
-        var directives = ParseDirectives(false);
+        var directives = ParseDirectives(false, isQueryLocation: true);
         var selectionSet = _reader.Kind == TokenKind.LeftBrace
             ? ParseSelectionSet()
             : null;
diff --git a/src/HotChocolate/Language/src/Language.Utf8/Utf8GraphQLParser.Types.cs b/src/HotChocolate/Language/src/Language.Utf8/Utf8GraphQLParser.Types.cs
@@ -12,6 +12,7 @@ public ref partial struct Utf8GraphQLParser
     /// </summary>
     private ITypeNode ParseTypeReference()
     {
+        IncreaseDepth();
         ITypeNode type;
         Location? location;
 
@@ -40,6 +41,7 @@ private ITypeNode ParseTypeReference()
                 MoveNext();
                 location = CreateLocation(in start);
 
+                DecreaseDepth();
                 return new NonNullTypeNode
                 (
                     location,
@@ -50,6 +52,7 @@ private ITypeNode ParseTypeReference()
             Unexpected(TokenKind.Bang);
         }
 
+        DecreaseDepth();
         return type;
     }
 
diff --git a/src/HotChocolate/Language/src/Language.Utf8/Utf8GraphQLParser.Utilities.cs b/src/HotChocolate/Language/src/Language.Utf8/Utf8GraphQLParser.Utilities.cs
@@ -27,6 +27,25 @@ internal NameNode ParseName()
     [MethodImpl(MethodImplOptions.AggressiveInlining)]
     internal bool MoveNext() => _reader.MoveNext();
 
+    [MethodImpl(MethodImplOptions.AggressiveInlining)]
+    private void IncreaseDepth()
+    {
+        if (++_recursionDepth > _maxAllowedRecursionDepth)
+        {
+            throw new SyntaxException(
+                _reader,
+                string.Format(
+                    Utf8GraphQLParser_Start_MaxAllowedRecursionDepthReached,
+                    _maxAllowedRecursionDepth));
+        }
+    }
+
+    [MethodImpl(MethodImplOptions.AggressiveInlining)]
+    private void DecreaseDepth()
+    {
+        --_recursionDepth;
+    }
+
     [MethodImpl(MethodImplOptions.AggressiveInlining)]
     private TokenInfo Start()
     {
diff --git a/src/HotChocolate/Language/src/Language.Utf8/Utf8GraphQLParser.Values.cs b/src/HotChocolate/Language/src/Language.Utf8/Utf8GraphQLParser.Values.cs
@@ -32,32 +32,37 @@ public ref partial struct Utf8GraphQLParser
     /// </param>
     internal IValueNode ParseValueLiteral(bool isConstant)
     {
+        IncreaseDepth();
+
+        IValueNode node;
+
         if (_reader.Kind == TokenKind.LeftBracket)
         {
-            return ParseList(isConstant);
+            node = ParseList(isConstant);
         }
-
-        if (_reader.Kind == TokenKind.LeftBrace)
+        else if (_reader.Kind == TokenKind.LeftBrace)
         {
-            return ParseObject(isConstant);
+            node = ParseObject(isConstant);
         }
-
-        if (TokenHelper.IsScalarValue(in _reader))
+        else if (TokenHelper.IsScalarValue(in _reader))
         {
-            return ParseScalarValue();
+            node = ParseScalarValue();
         }
-
-        if (_reader.Kind == TokenKind.Name)
+        else if (_reader.Kind == TokenKind.Name)
         {
-            return ParseEnumValue();
+            node = ParseEnumValue();
         }
-
-        if (_reader.Kind == TokenKind.Dollar && !isConstant)
+        else if (_reader.Kind == TokenKind.Dollar && !isConstant)
+        {
+            node = ParseVariable();
+        }
+        else
         {
-            return ParseVariable();
+            throw Unexpected(_reader.Kind);
         }
 
-        throw Unexpected(_reader.Kind);
+        DecreaseDepth();
+        return node;
     }
 
     [MethodImpl(MethodImplOptions.AggressiveInlining)]
diff --git a/src/HotChocolate/Language/src/Language.Utf8/Utf8GraphQLParser.cs b/src/HotChocolate/Language/src/Language.Utf8/Utf8GraphQLParser.cs
@@ -12,10 +12,13 @@ public ref partial struct Utf8GraphQLParser
     private readonly bool _allowFragmentVars;
     private readonly int _maxAllowedNodes;
     private readonly int _maxAllowedFields;
+    private readonly int _maxAllowedDirectives;
+    private readonly int _maxAllowedRecursionDepth;
     private Utf8GraphQLReader _reader;
     private StringValueNode? _description;
     private int _parsedNodes;
     private int _parsedFields;
+    private int _recursionDepth;
 
     public Utf8GraphQLParser(
         ReadOnlySpan<byte> graphQLData,
@@ -31,6 +34,8 @@ public Utf8GraphQLParser(
         _allowFragmentVars = options.Experimental.AllowFragmentVariables;
         _maxAllowedNodes = options.MaxAllowedNodes;
         _maxAllowedFields = options.MaxAllowedFields;
+        _maxAllowedDirectives = options.MaxAllowedDirectives;
+        _maxAllowedRecursionDepth = options.MaxAllowedRecursionDepth;
         _reader = new Utf8GraphQLReader(graphQLData, options.MaxAllowedTokens);
         _description = null;
     }
@@ -49,6 +54,8 @@ internal Utf8GraphQLParser(
         _allowFragmentVars = options.Experimental.AllowFragmentVariables;
         _maxAllowedNodes = options.MaxAllowedNodes;
         _maxAllowedFields = options.MaxAllowedFields;
+        _maxAllowedDirectives = options.MaxAllowedDirectives;
+        _maxAllowedRecursionDepth = options.MaxAllowedRecursionDepth;
         _reader = reader;
         _description = null;
     }
@@ -72,6 +79,7 @@ internal Utf8GraphQLParser(
     public DocumentNode Parse()
     {
         _parsedNodes = 0;
+        _recursionDepth = 0;
         var definitions = new List<IDefinitionNode>();
 
         var start = Start();

Original file line number	Diff line number	Diff line change
`@@ -1,5 +1,6 @@`
`1`	`1`	`using System.Collections.Generic;`
`2`	`2`	`using System.Runtime.CompilerServices;`
	`3`	`+using static HotChocolate.Language.Properties.LangUtf8Resources;`
`3`	`4`
`4`	`5`	`namespace HotChocolate.Language;`
`5`	`6`
`@@ -65,7 +66,7 @@ private NameNode ParseDirectiveLocation()`
`65`	`66`	`throw Unexpected(kind);`
`66`	`67`	`}`
`67`	`68`
`68`		`- private List<DirectiveNode> ParseDirectives(bool isConstant)`
	`69`	`+ private List<DirectiveNode> ParseDirectives(bool isConstant, bool isQueryLocation = false)`
`69`	`70`	`{`
`70`	`71`	`if (_reader.Kind == TokenKind.At)`
`71`	`72`	`{`
`@@ -74,6 +75,15 @@ private List<DirectiveNode> ParseDirectives(bool isConstant)`
`74`	`75`	`while (_reader.Kind == TokenKind.At)`
`75`	`76`	`{`
`76`	`77`	`list.Add(ParseDirective(isConstant));`
	`78`	`+`
	`79`	`+ if (isQueryLocation && list.Count > _maxAllowedDirectives)`
	`80`	`+ {`
	`81`	`+ throw new SyntaxException(`
	`82`	`+ _reader,`
	`83`	`+ string.Format(`
	`84`	`+ Utf8GraphQLParser_ParseDirective_MaxAllowedDirectivesReached,`
	`85`	`+ _maxAllowedDirectives));`
	`86`	`+ }`
`77`	`87`	`}`
`78`	`88`
`79`	`89`	`return list;`
Original file line number	Diff line number	Diff line change
`@@ -12,6 +12,7 @@ public ref partial struct Utf8GraphQLParser`
`12`	`12`	`/// </summary>`
`13`	`13`	`private ITypeNode ParseTypeReference()`
`14`	`14`	`{`
	`15`	`+ IncreaseDepth();`
`15`	`16`	`ITypeNode type;`
`16`	`17`	`Location? location;`
`17`	`18`
`@@ -40,6 +41,7 @@ private ITypeNode ParseTypeReference()`
`40`	`41`	`MoveNext();`
`41`	`42`	`location = CreateLocation(in start);`
`42`	`43`
	`44`	`+ DecreaseDepth();`
`43`	`45`	`return new NonNullTypeNode`
`44`	`46`	`(`
`45`	`47`	`location,`
`@@ -50,6 +52,7 @@ private ITypeNode ParseTypeReference()`
`50`	`52`	`Unexpected(TokenKind.Bang);`
`51`	`53`	`}`
`52`	`54`
	`55`	`+ DecreaseDepth();`
`53`	`56`	`return type;`
`54`	`57`	`}`
`55`	`58`