Skip to content

Reject non-finite Float values - #5713

Merged
rmosolgo merged 1 commit into
rmosolgo:masterfrom
ydah:reject-non-finite-float-values
Aug 27, 2026
Merged

Reject non-finite Float values#5713
rmosolgo merged 1 commit into
rmosolgo:masterfrom
ydah:reject-non-finite-float-values

Conversation

@ydah

@ydah ydah commented Aug 27, 2026

Copy link
Copy Markdown
Contributor

GraphQL Float values must be finite, but GraphQL::Types::Float currently accepts any Numeric value after calling to_f.
This allows non-finite values through both input and result coercion:

Schema.execute("{ echo(value: 1e400) }")
# => Infinity is accepted as input

result = Schema.execute("{ nan }")
JSON.generate(result.to_h)
# => JSON::GeneratorError: NaN not allowed in JSON

Variables containing Float::NAN or infinity are also accepted. For result values, the failure occurs later during HTTP response serialization instead of being reported by GraphQL-Ruby.

This PR adds finite-value checks to Float coercion, following the existing Int error-handling pattern. Invalid inputs are routed through Schema#type_error using FloatDecodingError, while invalid result values raise FloatEncodingError with field and response-path context.

Variable validation errors and serialized GraphQL values also represent non-finite floats as strings, keeping error responses JSON-safe.

@rmosolgo

Copy link
Copy Markdown
Owner

Looks good to me. This might result in errors being raised where previously these values were being allowed through, but this is correct according to the spec:

Non-finite floating-point internal values (NaN and Infinity) cannot be coerced to Float and must raise a field error.

https://spec.graphql.org/September2025/#sel-GAHXTFHCAACIBx4Q

@rmosolgo
rmosolgo merged commit 3d43cfd into rmosolgo:master Aug 27, 2026
12 of 15 checks passed
@rmosolgo rmosolgo added this to the 2.6.10 milestone Aug 27, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants