search

vektah / gqlparser

A port of the parser from graphql-js into golang
MIT License
498 stars 123 forks source link

go vuln check issue #330

Closed ankitpatial closed 3 days ago

ankitpatial commented 4 days ago

What happened?

excuting govulncheck -show verbose ./... results in

Vulnerability #1: GO-2024-2920
    Denial of service vulnerability via the parseDirectives function in
    github.com/vektah/gqlparser
  More info: https://pkg.go.dev/vuln/GO-2024-2920
  Module: github.com/vektah/gqlparser
    Found in: github.com/vektah/gqlparser@v1.3.1
    Fixed in: N/A

What did you expect?

no issue reported

Minimal graphql.schema and models to reproduce

versions

StevenACoffman commented 4 days ago

The vulnerability is in github.com/vektah/gqlparser@v1.3.1 not in any version after that.

StevenACoffman commented 3 days ago

https://pkg.go.dev/vuln/GO-2024-2920 shows that v2 has no vulnerabilities after v2.5.14

ankitpatial commented 2 days ago

Thank you for checking on it.