Prevent infinite loop on invalid introspection (#1509)

graphql · Sep 6, 2018 · 6b033c2 · 6b033c2
1 parent 6963fc8
commit 6b033c2
Show file tree

Hide file tree

Showing 2 changed files with 39 additions and 2 deletions.
diff --git a/src/utilities/__tests__/buildClientSchema-test.js b/src/utilities/__tests__/buildClientSchema-test.js
@@ -844,4 +844,41 @@ describe('Type System: build schema from introspection', () => {
       buildClientSchema(introspection);
     });
   });
+
+  describe('prevents infinite recursion on invalid introspection', () => {
+    it('recursive interfaces', () => {
+      const introspection = {
+        __schema: {
+          types: [
+            {
+              name: 'Foo',
+              kind: 'OBJECT',
+              fields: [],
+              interfaces: [{ name: 'Foo' }],
+            },
+          ],
+        },
+      };
+      expect(() => buildClientSchema(introspection)).to.throw(
+        'Expected Foo to be a GraphQL Interface type.',
+      );
+    });
+
+    it('recursive union', () => {
+      const introspection = {
+        __schema: {
+          types: [
+            {
+              name: 'Foo',
+              kind: 'UNION',
+              possibleTypes: [{ name: 'Foo' }],
+            },
+          ],
+        },
+      };
+      expect(() => buildClientSchema(introspection)).to.throw(
+        'Expected Foo to be a GraphQL Object type.',
+      );
+    });
+  });
 });
diff --git a/src/utilities/buildClientSchema.js b/src/utilities/buildClientSchema.js
@@ -221,7 +221,7 @@ export function buildClientSchema(
     return new GraphQLObjectType({
       name: objectIntrospection.name,
       description: objectIntrospection.description,
-      interfaces: objectIntrospection.interfaces.map(getInterfaceType),
+      interfaces: () => objectIntrospection.interfaces.map(getInterfaceType),
       fields: () => buildFieldDefMap(objectIntrospection),
     });
   }
@@ -248,7 +248,7 @@ export function buildClientSchema(
     return new GraphQLUnionType({
       name: unionIntrospection.name,
       description: unionIntrospection.description,
-      types: unionIntrospection.possibleTypes.map(getObjectType),
+      types: () => unionIntrospection.possibleTypes.map(getObjectType),
     });
   }