Skip to content

bound Int coercion before expanding BigDecimal to BigInteger - #4495

Open
nab-iha3 wants to merge 1 commit into
graphql-java:masterfrom
nab-iha3:int-coercion-bigdecimal-bound
Open

nab-iha3 wants to merge 1 commit into
graphql-java:masterfrom
nab-iha3:int-coercion-bigdecimal-bound

Conversation

@nab-iha3

Copy link
Copy Markdown
Contributor

variable coercion hands the raw value straight to Coercing.parseValue, so an Int-typed variable that arrives as a BigDecimal (gson, or jackson with USE_BIG_DECIMAL_FOR_FLOATS) reaches GraphqlIntCoercing.convertParseValueImpl.

new BigDecimal("1E50000000").toBigIntegerExact()   // ~14s, 166M-bit BigInteger

toBigIntegerExact() runs before the INT_MIN/INT_MAX range check in parseValueImpl, so an 11-byte value forces a ~50M digit BigInteger to be built only to then be rejected as out of range. bigger exponents scale into minutes and gigabytes before BigInteger reaches its own size limit. the literal path is capped at 100 numeric chars by the parser; the variable path has no such cap.

decide out-of-range from the decimal scale/precision rather than expanding first: an integer part with more than 10 digits cannot fit an Int, so the existing Int.outsideRange error is raised there. BigDecimal.intValueExact() already short-circuits the same way, which is why the serialize path and the Float/Boolean/ID coercers are not affected.

@github-actions

Copy link
Copy Markdown
Contributor

Test Report

Test Results

Java Version Total Passed Failed Errors Skipped
Java 11 5963 (+1 🟢) 5907 (+1 🟢) 0 (±0) 0 (±0) 56 (±0)
Java 17 5963 (+1 🟢) 5906 (+1 🟢) 0 (±0) 0 (±0) 57 (±0)
Java 21 5963 (+1 🟢) 5906 (+1 🟢) 0 (±0) 0 (±0) 57 (±0)
Java 25 5963 (+1 🟢) 5906 (+1 🟢) 0 (±0) 0 (±0) 57 (±0)
jcstress 32 (±0) 32 (±0) 0 (±0) 0 (±0) 0 (±0)
Total 23884 (+4 🟢) 23657 (+4 🟢) 0 (±0) 0 (±0) 227 (±0)

Code Coverage (Java 25)

Metric Covered Missed Coverage vs Master
Lines 30143 3118 90.6% ±0.0%
Branches 8840 1520 85.3% ±0.0%
Methods 8048 1207 87.0% ±0.0%

Changed Class Coverage (1 class)

Class Line Branch Method
g.s.GraphqlIntCoercing +0.3% 🟢 +0.3% 🟢 ±0.0%

Full HTML report: build artifact jacoco-html-report

Updated: 2026-10-12 17:33:29 UTC

This branch has not been deployed

No deployments
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant