fix: count comment tokens toward the parser max_tokens limit

Comment tokens are read, allocated as Token objects, and chained into the
token list, but advance_lexer only counted the non-comment tokens it returned.
A comment-padded document could bypass max_tokens while still allocating one
token per comment, exhausting memory.

Count the comments skipped between the previous and current token (including
the advance onto EOF, covering trailing comments) so every allocated token
counts toward the limit.

Author: Cito

src/graphql/language/parser.py

@@ -1355,18 +1355,33 @@ def delimited_many(
         return nodes
 
     def advance_lexer(self) -> None:
-        token = self._lexer.advance()
-
-        if token.kind != TokenKind.EOF:
+        """Advance the lexer.
+
+        Counts every token that is consumed toward ``max_tokens``, including the
+        comment tokens that the lexer skips over between the previously focused token
+        and the new one. Comments are read and allocated as ``Token`` objects (and
+        chained into the token list) but are not returned by the lexer, so counting
+        only the returned tokens would let a comment-padded document bypass
+        ``max_tokens`` while still allocating one token per comment.
+        """
+        lexer = self._lexer
+        token = lexer.advance()
+        # Count the comment tokens that were skipped since the previously focused
+        # token. They are the nodes strictly between ``last_token`` and ``token`` in
+        # the token linked-list (the lexer only ever skips comments).
+        skipped = lexer.last_token.next
+        while skipped is not None and skipped is not token:
             self._token_counter += 1
-            max_tokens = self._max_tokens
-            if max_tokens is not None and self._token_counter > max_tokens:
-                raise GraphQLSyntaxError(
-                    self._lexer.source,
-                    token.start,
-                    f"Document contains more than {max_tokens} tokens."
-                    " Parsing aborted.",
-                )
+            skipped = skipped.next
+        if token.kind is not TokenKind.EOF:
+            self._token_counter += 1
+        max_tokens = self._max_tokens
+        if max_tokens is not None and self._token_counter > max_tokens:
+            raise GraphQLSyntaxError(
+                lexer.source,
+                token.start,
+                f"Document contains more than {max_tokens} tokens. Parsing aborted.",
+            )
 
 
 def get_token_desc(token: Token) -> str:

tests/language/test_parser.py

@@ -116,6 +116,35 @@ def limits_maximum_number_of_tokens():
         ):
             assert parse('{ foo(bar: "baz") }', max_tokens=7)
 
+    def counts_comment_tokens_towards_the_maximum():
+        # Comment tokens are read and allocated by the lexer but skipped over; they
+        # must still count towards max_tokens, otherwise a comment-padded document
+        # bypasses the limit (memory-exhaustion DoS) while allocating one token per
+        # comment. token_count reflects the comments too.
+        assert parse("{ # comment\n foo }").token_count == 4
+        assert parse("# leading\n{ foo }\n# trailing").token_count == 5
+
+        # An interspersed comment pushes the document over the limit.
+        parse("{ # c\n foo }", max_tokens=4)
+        with raises(
+            GraphQLSyntaxError,
+            match="Syntax Error:"
+            r" Document contains more than 3 tokens\. Parsing aborted\.",
+        ):
+            parse("{ # c\n foo }", max_tokens=3)
+
+        # Neither leading nor trailing comment padding can bypass the limit.
+        with raises(
+            GraphQLSyntaxError,
+            match=r"Document contains more than 5 tokens\. Parsing aborted\.",
+        ):
+            parse("# c\n" * 1000 + "{ a }", max_tokens=5)
+        with raises(
+            GraphQLSyntaxError,
+            match=r"Document contains more than 5 tokens\. Parsing aborted\.",
+        ):
+            parse("{ a }" + "\n# c" * 1000, max_tokens=5)
+
     def parses_variable_inline_values():
         parse("{ field(complex: { a: { b: [ $var ] } }) }")