Merge pull request #231 from wravery/limit-depth

Add a configurable depth limit to the parser

Author: wravery

include/graphqlservice/GraphQLParse.h

@@ -34,11 +34,17 @@ struct ast
 	bool validated = false;
 };
 
-GRAPHQLPEG_EXPORT ast parseSchemaString(std::string_view input);
-GRAPHQLPEG_EXPORT ast parseSchemaFile(std::string_view filename);
+// By default, we want to limit the depth of nested nodes. You can override this with
+// another value for the depthLimit parameter in these parse functions.
+constexpr size_t c_defaultDepthLimit = 25;
 
-GRAPHQLPEG_EXPORT ast parseString(std::string_view input);
-GRAPHQLPEG_EXPORT ast parseFile(std::string_view filename);
+GRAPHQLPEG_EXPORT ast parseSchemaString(
+	std::string_view input, size_t depthLimit = c_defaultDepthLimit);
+GRAPHQLPEG_EXPORT ast parseSchemaFile(
+	std::string_view filename, size_t depthLimit = c_defaultDepthLimit);
+
+GRAPHQLPEG_EXPORT ast parseString(std::string_view input, size_t depthLimit = c_defaultDepthLimit);
+GRAPHQLPEG_EXPORT ast parseFile(std::string_view filename, size_t depthLimit = c_defaultDepthLimit);
 
 } // namespace peg
 

include/graphqlservice/internal/SyntaxTree.h

@@ -146,9 +146,34 @@ class ast_node
 	std::unique_ptr<unescaped_t> _unescaped;
 };
 
+template <class ParseInput>
+class depth_limit_input : public ParseInput
+{
+public:
+	template <typename... Args>
+	explicit depth_limit_input(size_t depthLimit, Args&&... args) noexcept
+		: ParseInput(std::forward<Args>(args)...)
+		, _depthLimit(depthLimit)
+	{
+	}
+
+	size_t depthLimit() const noexcept
+	{
+		return _depthLimit;
+	}
+
+	size_t selectionSetDepth = 0;
+
+private:
+	const size_t _depthLimit;
+};
+
+using ast_file = depth_limit_input<file_input<>>;
+using ast_memory = depth_limit_input<memory_input<>>;
+
 struct ast_input
 {
-	std::variant<std::vector<char>, std::unique_ptr<file_input<>>, std::string_view> data;
+	std::variant<std::vector<char>, std::unique_ptr<ast_file>, std::string_view> data;
 };
 
 } // namespace graphql::peg