Repository navigation
Fix silent numeric overflow in argument and input binding - #2783
RoMiRoSSaN wants to merge 2 commits into
Conversation
|
Thanks! Can you have a look at the failing tests please? |
Reject out-of-range numbers instead of silently wrapping them, and accept Int.MIN_VALUE. Narrowing to Java numeric types is exact, including fields of input objects; overflow, fractions and non-finite floats are errors. Preserve converted numeric default values in SDL and introspection. Distinguish fractional Int literals from values outside the Int range. Cover numeric bindings, literal conversion, default values and diagnostics with regression tests.
afb974f to
bfa01e9
Compare
phillip-kruger
left a comment
There was a problem hiding this comment.
CI is green on the current head, and server/implementation passes locally (1622 tests).
One thing for the description, so it ends up in the release notes: this also changes output, not just input binding. NumberCoercing.serialize now rejects NaN/Infinity on Float fields, and fractions or out-of-range values on Int fields. A resolver that used to return Double.NaN will now get a field error. That's correct per the spec, but users will notice it, so please mention it in the PR description.
server/implementation/src/main/java/io/smallrye/graphql/scalar/number/NumberCoercing.java line 592:
serialize now goes through the same exact and finite checks, so a resolver that returns NaN, Infinity or an out-of-range value now gets an error. That's spec-correct, but it changes behaviour on the output side, so please call it out in the PR description.
Skip the numeric component shortcut when a field has a transformation so that NumberFormat still formats each array element as a string. Cover primitive and boxed arrays, arrays inside lists, and null elements. Characterize Optional argument, POJO field, and record component binding without changing the existing Optional contract.
Fixes #2781
Changes
IntegerScalar: the range check is exact and includes both bounds.Int.MIN_VALUEis accepted.byte,short,int,long, atomic andOptional*wrappers): the conversion is exact.intValue()and casts are replaced with*ValueExact, so overflow and fractions return a GraphQL error.float,double,OptionalDouble):NaN,Infinityand finite overflow return a GraphQL error. Normal IEEE rounding is kept.OptionalInt/OptionalLong/OptionalDoublearguments: passed asOptional*.empty()instead ofnull.BigInteger,BigDecimaland the schema.Before / after
int2147483648-2147483648int-2147483648-2147483648int1.51byte128-128long9223372036854775808-9223372036854775808float1e39Infinityintfield-999999999999999999999999999991610612737, or an unrelatedUnknown Scalar TypeerrorExample error after the fix: