[Bug] GraphQL SearchCriteriaValidator not loaded — removed by module-graph-ql di.xml array override by mtytula · Pull Request #40742 · magento/magento2

mtytula · 2026-04-15T13:56:47Z

Preconditions

Magento 2.4.7-p9 (magento/module-graph-ql 100.4.7-p9)
Any GraphQL query with pageSize or currentPage arguments

Steps to reproduce

Execute any GraphQL query with pageSize exceeding the configured limit, e.g.:

{
    products(search: "test", pageSize: 999) {
        items {
            sku
        }
    }
}

Expected result

GraphQL returns a validation error:

{
    "data": {
        "products": null
    },
    "errors": [
        {
            "message": "Maximum pageSize is 10",
            "path": [
                "products"
            ],
            "locations": [
                {
                    "line": 2,
                    "column": 5
                }
            ],
            "extensions": {
                "category": "graphql-input"
            }
        }
    ]
}

(Maximum pageSize is X — where X is the configured maxPageSize value, default 300)

Actual result

Query executes without validation. pageSize: 999 is accepted silently. No error is returned.

Root cause

SearchCriteriaValidator (which enforces maxPageSize: 300) is registered
in magento2-base/app/etc/di.xml (primary config):

<!-- magento2-base/app/etc/di.xml -->
<type name="Magento\Framework\GraphQl\Query\Resolver\Argument\Validator\CompositeValidator">
    <arguments>
        <argument name="validators" xsi:type="array">
            <item name="searchCriteriaValidator" xsi:type="object">
                Magento\Framework\GraphQl\Query\Resolver\Argument\Validator\SearchCriteriaValidator
            </item>
        </argument>
    </arguments>
</type>

module-graph-ql/etc/di.xml (module config) also defines validators for the
same type, but only with backpressureValidator:

<!-- module-graph-ql/etc/di.xml -->
<type name="Magento\Framework\GraphQl\Query\Resolver\Argument\Validator\CompositeValidator">
    <arguments>
        <argument name="validators" xsi:type="array">
            <item name="backpressureValidator" xsi:type="object">
                Magento\GraphQl\Model\Backpressure\BackpressureFieldValidator
            </item>
        </argument>
    </arguments>
</type>

Module-level DI configuration has higher priority than primary config.
When module config defines the same xsi:type="array" argument, it replaces
the primary config's array — it does not merge items. As a result,
searchCriteriaValidator is silently dropped.

Verification at runtime:

$validator = $objectManager->get(
    \Magento\Framework\GraphQl\Query\Resolver\Argument\Validator\CompositeValidator::class
);
$ref = new ReflectionClass($validator);
$prop = $ref->getProperty('validators');
$prop->setAccessible(true);
var_dump(array_keys($prop->getValue($validator)));
// Output: ['backpressureValidator']
// Expected: ['searchCriteriaValidator', 'backpressureValidator']

Proposed fix

Move searchCriteriaValidator registration from magento2-base/app/etc/di.xml
to module-graph-ql/etc/di.xml. Both validators should live at module level
so that future validators added by third-party modules can safely merge via
xsi:type="array".

`module-graph-ql/etc/di.xml` — after fix

<type name="Magento\Framework\GraphQl\Query\Resolver\Argument\Validator\CompositeValidator">
    <arguments>
        <argument name="validators" xsi:type="array">
            <item name="searchCriteriaValidator" xsi:type="object">
                Magento\Framework\GraphQl\Query\Resolver\Argument\Validator\SearchCriteriaValidator
            </item>
            <item name="backpressureValidator" xsi:type="object">
                Magento\GraphQl\Model\Backpressure\BackpressureFieldValidator
            </item>
        </argument>
    </arguments>
</type>

`magento2-base/app/etc/di.xml` — remove this block

<!-- REMOVE: -->
<type name="Magento\Framework\GraphQl\Query\Resolver\Argument\Validator\CompositeValidator">
    <arguments>
        <argument name="validators" xsi:type="array">
            <item name="searchCriteriaValidator" xsi:type="object">
                Magento\Framework\GraphQl\Query\Resolver\Argument\Validator\SearchCriteriaValidator
            </item>
        </argument>
    </arguments>
</type>

Contribution checklist (*)

Pull request has a meaningful description of its purpose
All commits are accompanied by meaningful commit messages
All new or changed code is covered with unit/integration tests (if applicable)
README.md files for modified modules are updated and included in the pull request if any predefined sections require an update
All automated tests passed successfully (all builds are green)

Temporary workaround (composer patch)

Until the upstream fix is merged — apply a patch via cweagans/composer-patches.

1. `composer.json`

"extra": {
    "composer-exit-on-patch-failure": true,
    "patches": {
        "magento/module-graph-ql": {
            "Fix search criteria composite validator": "patches/magento/module-graph-ql/fix-search-validator.diff"
        }
    }
}

2. `patches/magento/module-graph-ql/fix-search-validator.diff`

Index: etc/di.xml
===================================================================
--- a/etc/di.xml
+++ b/etc/di.xml
@@ -107,6 +107,7 @@
     <type name="Magento\Framework\GraphQl\Query\Resolver\Argument\Validator\CompositeValidator">
         <arguments>
             <argument name="validators" xsi:type="array">
+                <item name="searchCriteriaValidator" xsi:type="object">Magento\Framework\GraphQl\Query\Resolver\Argument\Validator\SearchCriteriaValidator</item>
                 <item name="backpressureValidator" xsi:type="object">
                     Magento\GraphQl\Model\Backpressure\BackpressureFieldValidator
                 </item>

3. Apply

composer require cweagans/composer-patches --no-update
composer update magento/module-graph-ql
# or simply:
composer install

Affected repositories

magento/magento2 — app/etc/di.xml (magento2-base)
magento/module-graph-ql — etc/di.xml

Affected versions

All versions of magento/module-graph-ql that introduced backpressureValidator
(i.e. all versions that define CompositeValidator type in their etc/di.xml).

Resolved issues:

resolves [Issue] [Bug] GraphQL SearchCriteriaValidator not loaded — removed by module-graph-ql di.xml array override #40762: [Bug] GraphQL SearchCriteriaValidator not loaded — removed by module-graph-ql di.xml array override

m2-assistant · 2026-04-15T13:56:52Z

Hi @mtytula. Thank you for your contribution!
Here are some useful tips on how you can test your changes using Magento test environment.
❗ Automated tests can be triggered manually with an appropriate comment:

@magento run all tests - run or re-run all required tests against the PR changes
@magento run <test-build(s)> - run or re-run specific test build(s)
For example: @magento run Unit Tests

<test-build(s)> is a comma-separated list of build names.

Allowed build names are:

Database Compare
Functional Tests CE
Functional Tests EE
Functional Tests B2B
Integration Tests
Magento Health Index
Sample Data Tests CE
Sample Data Tests EE
Sample Data Tests B2B
Static Tests
Unit Tests
WebAPI Tests
Semantic Version Checker

You can find more information about the builds here
ℹ️ Run only required test builds during development. Run all test builds before sending your pull request for review.

For more details, review the Code Contributions documentation.
Join Magento Community Engineering Slack and ask your questions in #github channel.

ct-prd-pr-scan · 2026-04-15T13:56:59Z

The security team has been informed about this pull request due to the presence of risky security keywords. For security vulnerability reports, please visit Adobe's vulnerability disclosure program on HackerOne or email psirt@adobe.com.

ct-prd-pr-scan · 2026-04-15T14:02:31Z

The security team has been informed about this pull request due to the presence of risky security keywords. For security vulnerability reports, please visit Adobe's vulnerability disclosure program on HackerOne or email psirt@adobe.com.

ct-prd-pr-scan · 2026-04-15T14:02:46Z

The security team has been informed about this pull request due to the presence of risky security keywords. For security vulnerability reports, please visit Adobe's vulnerability disclosure program on HackerOne or email psirt@adobe.com.

mtytula · 2026-04-15T17:33:28Z

@magento run all tests

ct-prd-pr-scan · 2026-04-15T18:40:30Z

The security team has been informed about this pull request due to the presence of risky security keywords. For security vulnerability reports, please visit Adobe's vulnerability disclosure program on HackerOne or email psirt@adobe.com.

ct-prd-pr-scan · 2026-04-15T18:41:52Z

The security team has been informed about this pull request due to the presence of risky security keywords. For security vulnerability reports, please visit Adobe's vulnerability disclosure program on HackerOne or email psirt@adobe.com.

engcom-Dash · 2026-04-21T11:36:11Z

@magento create issue

ct-prd-pr-scan · 2026-04-21T11:36:21Z

The security team has been informed about this pull request due to the presence of risky security keywords. For security vulnerability reports, please visit Adobe's vulnerability disclosure program on HackerOne or email psirt@adobe.com.

mtytula · 2026-04-27T19:35:01Z

@magento add to contributors team

m2-assistant · 2026-04-27T19:35:06Z

Hi @mtytula! 👋
Thank you for joining. Please accept team invitation 👉 here 👈 and add your comment one more time.

engcom-Hotel · 2026-05-05T07:39:16Z

@magento run all tests

engcom-Hotel

Hello @mtytula,

Thank you for the contribution!

The code changes looks good to us and the failed tests seems either flaky or known issues.

But can you please add some automated test in accordance to the DOD.

Thank you

mtytula · 2026-05-06T09:19:16Z

@magento run all tests

mtytula · 2026-05-06T09:19:51Z

Hello @mtytula,

Thank you for the contribution!

The code changes looks good to us and the failed tests seems either flaky or known issues.

But can you please add some automated test in accordance to the DOD.

Thank you

Done :)

ct-prd-pr-scan · 2026-05-06T09:21:52Z

The security team has been informed about this pull request due to the presence of risky security keywords. For security vulnerability reports, please visit Adobe's vulnerability disclosure program on HackerOne or email psirt@adobe.com.

ct-prd-pr-scan · 2026-05-06T09:22:07Z

The security team has been informed about this pull request due to the presence of risky security keywords. For security vulnerability reports, please visit Adobe's vulnerability disclosure program on HackerOne or email psirt@adobe.com.

…ement

mtytula · 2026-05-06T11:41:56Z

@magento run all tests

…ement

mtytula · 2026-05-06T13:52:07Z

@magento run all tests

mtytula · 2026-05-06T19:36:46Z

@engcom-Hotel @engcom-Dash

My tests passed 🚀

engcom-Hotel

Thank you @mtytula for making the changes, approving this PR for further process

engcom-Bravo · 2026-05-11T09:11:28Z

Hi @mtytula,

Thanks for the collaboration & contribution!

✔️ QA Passed

Preconditions:

Install fresh Magento 2.4-develop

Steps to Reproduce

Execute any GraphQL query with pageSize exceeding the configured limit, e.g.:

{
    products(search: "test", pageSize: 999) {
        items {
            sku
        }
    }
}

Before: ✖️

After: ✔️

{
  "errors": [
    {
      "message": "Maximum pageSize is 10.",
      "locations": [
        {
          "line": 6,
          "column": 5
        }
      ],
      "path": [
        "products"
      ],
      "extensions": {
        "category": "graphql-input"
      }
    }
  ]

Builds are failed. Hence, moving this PR to Extended Testing.

Thanks.

engcom-Dash · 2026-05-12T06:27:59Z

@magento run all tests

engcom-Dash · 2026-05-12T09:44:57Z

@magento run Unit Tests

engcom-Dash · 2026-05-12T09:56:37Z

A few of the Functional and Web API failures are not consistent in the recent 2 builds. They are neither failing because of the PR nor part of the PR, considered to be flaky. The consistent failures are known issues, hence moving this PR to Merge in Progress.

CE
Build 1
https://public-results-storage-prod.magento-testing-service.engineering/reports/magento/magento2/pull/40742/8849ad1ff0e9ff8517f305f6bc1c7028/Functional/allure-report-ce/index.html#categories

Build 2
https://public-results-storage-prod.magento-testing-service.engineering/reports/magento/magento2/pull/40742/7f8a48c661e2d8f513590bdf3f4d6ec5/Functional/allure-report-ce/index.html#categories

EE
Build1
https://public-results-storage-prod.magento-testing-service.engineering/reports/magento/magento2/pull/40742/6b4ec78fd51fc9ada05f9e1214e26955/Functional/allure-report-ee/index.html#categories

Build2
https://public-results-storage-prod.magento-testing-service.engineering/reports/magento/magento2/pull/40742/acaa1d6ca430374f64f558c5e71d73a1/Functional/allure-report-ee/index.html

B2B
Build1
https://public-results-storage-prod.magento-testing-service.engineering/reports/magento/magento2/pull/40742/d8f9425cf3020e8b211c65c81d0b19a7/Functional/allure-report-b2b/index.html

Build2
https://public-results-storage-prod.magento-testing-service.engineering/reports/magento/magento2/pull/40742/bbc4e08c488d51c059437ce00d7dea08/Functional/allure-report-b2b/index.html

WebAPI
Build 1
https://public-results-storage-prod.magento-testing-service.engineering/reports/magento/magento2/pull/40742/70baa3fcb5580b87b335e60466f343ee/Integration/console-error-logs.html

Build2
https://public-results-storage-prod.magento-testing-service.engineering/reports/magento/magento2/pull/40742/7d3eeccf53af3a01f682888b138f1004/WebApi/console-error-logs.html

Known Issue
TextInlineWidgetEditingSpecialCharacterTest - https://jira.corp.adobe.com/browse/ACQE-9803
https://jira.corp.adobe.com/browse/AC-17120 webpai failure ticket

Fixed search criteria validator

20b7fb5

mtytula changed the title ~~Fixed search criteria validator~~ [Bug] GraphQL SearchCriteriaValidator not loaded — removed by module-graph-ql di.xml array override Apr 15, 2026

m2-assistant Bot mentioned this pull request Apr 21, 2026

[Issue] [Bug] GraphQL SearchCriteriaValidator not loaded — removed by module-graph-ql di.xml array override #40762

Closed

2 of 5 tasks

engcom-Dash added the Priority: P3 May be fixed according to the position in the backlog. label Apr 21, 2026

ct-prd-projects-boards-automation Bot added this to Pull Requests Dashboard Apr 21, 2026

github-project-automation Bot moved this to Pending Review in Pull Requests Dashboard Apr 21, 2026

ct-prd-projects-boards-automation Bot added the Progress: pending review label Apr 21, 2026

Merge branch '2.4-develop' into fix/graphql-page-size-limit

9310bb4

Merge branch '2.4-develop' into fix/graphql-page-size-limit

5366e43

engcom-Charlie added the Project: Community Picked PRs upvoted by the community label May 4, 2026

ct-prd-projects-boards-automation Bot added this to Community Dashboard May 4, 2026

ct-prd-projects-boards-automation Bot moved this to Pending Review in Community Dashboard May 4, 2026

ct-prd-projects-boards-automation Bot removed this from Pull Requests Dashboard May 4, 2026

Merge branch '2.4-develop' into fix/graphql-page-size-limit

c5c3fbd

engcom-Hotel requested changes May 5, 2026

View reviewed changes

engcom-Hotel moved this from Pending Review to Changes Requested in Community Dashboard May 5, 2026

ct-prd-projects-boards-automation Bot added the Progress: needs update label May 5, 2026

engcom-Dash self-assigned this May 5, 2026

test(graphql): add automated tests for SearchCriteriaValidator enforc…

f5e2680

…ement

test(graphql): add automated tests for SearchCriteriaValidator enforc…

2e6713c

…ement

engcom-Hotel approved these changes May 7, 2026

View reviewed changes

ct-prd-projects-boards-automation Bot removed the Progress: review label May 7, 2026

ct-prd-projects-boards-automation Bot moved this from Review in Progress to Ready for Testing in Community Dashboard May 7, 2026

ct-prd-projects-boards-automation Bot added the Progress: ready for testing label May 7, 2026

engcom-Bravo self-assigned this May 8, 2026

ct-prd-projects-boards-automation Bot added Progress: testing in progress and removed Progress: ready for testing labels May 8, 2026

ct-prd-projects-boards-automation Bot moved this from Ready for Testing to Testing in Progress in Community Dashboard May 8, 2026

engcom-Bravo moved this from Testing in Progress to Extended testing (optional) in Community Dashboard May 11, 2026

Merge branch '2.4-develop' into fix/graphql-page-size-limit

c51178c

engcom-Dash moved this from Extended testing (optional) to Merge in Progress in Community Dashboard May 12, 2026

engcom-Dash added the Progress: deployment queue label May 13, 2026

magento-devops-reposync-svc merged commit 18d09bd into magento:2.4-develop May 20, 2026
8 of 12 checks passed

ct-prd-projects-boards-automation Bot moved this from Merge in Progress to Recently Merged in Community Dashboard May 20, 2026

mtytula deleted the fix/graphql-page-size-limit branch May 21, 2026 06:05

engcom-Dash removed the Progress: deployment queue label May 21, 2026

ilnytskyi mentioned this pull request Oct 16, 2026

Reject non-positive cart item quantities in REST API #41430

Open

4 of 5 tasks

Conversation

mtytula commented Apr 15, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Preconditions

Steps to reproduce

Expected result

Actual result

Root cause

Proposed fix

module-graph-ql/etc/di.xml — after fix

magento2-base/app/etc/di.xml — remove this block

Contribution checklist (*)

Temporary workaround (composer patch)

1. composer.json

2. patches/magento/module-graph-ql/fix-search-validator.diff

3. Apply

Affected repositories

Affected versions

Resolved issues:

Uh oh!

m2-assistant Bot commented Apr 15, 2026

Uh oh!

ct-prd-pr-scan Bot commented Apr 15, 2026

Uh oh!

ct-prd-pr-scan Bot commented Apr 15, 2026

Uh oh!

ct-prd-pr-scan Bot commented Apr 15, 2026

Uh oh!

mtytula commented Apr 15, 2026

Uh oh!

ct-prd-pr-scan Bot commented Apr 15, 2026

Uh oh!

ct-prd-pr-scan Bot commented Apr 15, 2026

Uh oh!

engcom-Dash commented Apr 21, 2026

Uh oh!

ct-prd-pr-scan Bot commented Apr 21, 2026

Uh oh!

mtytula commented Apr 27, 2026

Uh oh!

m2-assistant Bot commented Apr 27, 2026

Uh oh!

engcom-Hotel commented May 5, 2026

Uh oh!

engcom-Hotel left a comment

Choose a reason for hiding this comment

Uh oh!

mtytula commented May 6, 2026

Uh oh!

mtytula commented May 6, 2026

Uh oh!

ct-prd-pr-scan Bot commented May 6, 2026

Uh oh!

ct-prd-pr-scan Bot commented May 6, 2026

Uh oh!

mtytula commented May 6, 2026

Uh oh!

mtytula commented May 6, 2026

Uh oh!

mtytula commented May 6, 2026

Uh oh!

engcom-Hotel left a comment

Choose a reason for hiding this comment

Uh oh!

engcom-Bravo commented May 11, 2026

✔️ QA Passed

Uh oh!

engcom-Dash commented May 12, 2026

Uh oh!

engcom-Dash commented May 12, 2026

Uh oh!

engcom-Dash commented May 12, 2026

Uh oh!

Uh oh!

Reviewers

Uh oh!

Assignees

Labels

Projects

Milestone

mtytula commented Apr 15, 2026 •

edited

Loading

`module-graph-ql/etc/di.xml` — after fix

`magento2-base/app/etc/di.xml` — remove this block

1. `composer.json`

2. `patches/magento/module-graph-ql/fix-search-validator.diff`