MEDIUM 5.3 RubyGems
GraphQL-Ruby's Ruby lexer does not count comment tokens for the purposes of max_query_string_tokens
GHSA-3h96-34p3-xm76
Published · Modified
AI SAST
Find this class of vulnerability in your own code
Corgea's AI-native static analysis detects vulnerabilities like this one across your repositories, ranks them by exploitability, and returns review-ready fixes.
Description
GraphQL-Ruby's max_query_string_tokens configuration didn't count comment tokens against the limit, allowing strings to be processed even after the configured maximum had actually been reached.
In patched versions, the Ruby lexer does count these tokens.
GraphQL-CParser is not affected by this problem.
max_query_string_tokens was introduced in v2.3.1. Each 2.x version has received a new patch release for including a fix.
Ready to move
Start Securing
Free, no credit card | First findings in minutes