GraphQLSchema does not completely validate names
Author: ab-pmCreated Mar 24, 2025Updated Feb 12, 2026
The validateName function that is used to validate lots of schema parts is currently only checking that names are not reserved:
https://github.com/graphql/graphql-js/blob/6b253e7159a6a6c64c05bcc6bb863fef5a42eeb7/src/type/validate.ts#L206-L217
It should also check that the name complies with https://spec.graphql.org/October2021/#Name, e.g. by testing against the regex /^(?!__)[A-Za-z_][A-Za-z0-9_]*$/.
Otherwise it's possible to construct schemas (via the constructor, not by parsing) that upon printing would lead to invalid syntax, or fields which could never be queried. (Not the case, see below)
Source: graphql/graphql-js