3 ms·

> It's easy to construct a query which puts unreasonable load on your system. Can you give an example?

by SnowHill9902 4y ago

pdpi 4y ago
Details will depend on your schema, but the moral equivalent of “SELECT * FROM master_table” is a good start.
- withinboredom 4y ago
  Have you seen the “turn your database into a graphql schema” products? I shudder at the poor souls who used those products. I mean, I assume they are decent products, but man, it’s got to be so easy to screw it up and literally expose too much…
  - throwawaymaths 4y ago
    Hasura seems to be fine which we use internally in our company, though to be honest I don't do any complex queries and I don't think anyone is doing aggressively nested joins.
    - acdha 4y ago
      I think that can be part of the problem: if you use it for a few things which make sense, you get used to it and everyone thinks it's pretty solid after a while and probably starts using and likely exposing it in other areas. Then you get someone new writing different code or a clever attacker and it turns out there was a lot of room to expose unintended data or create performance issues.
      - throwawaymaths 4y ago
        I don't think hasura allows unbounded queries by default? I'm not 100% sure though, I didn't set it up at where I work.
- stickfigure 4y ago
  It's actually worse than that, because with graphql you can create a single query which is the moral equivalent of: SELECT * FROM master_table LEFT JOIN sub_table LEFT JOIN sub_sub_table LEFT_JOIN sub_sub_sub_table... ...which is effectively "dump everything". In a REST environment you'll at least need a lot more individual requests - that's both the blessing and curse.
lazyasciiart 4y ago
https://payatu.com/blog/manmeet/graphql-exploitation-part-4 https://payatu.com/blog/manmeet/graphql-exploitation-part-4 query dos { allDogs(onlyFree: false, limit: 1000000) { id veterinary { id dogs { id veterinary { id dogs { id veterinary { id dogs { .....

> It's easy to construct a query which puts unreasonable load on your system. Can you give an example?

pdpi 4y ago

Details will depend on your schema, but the moral equivalent of “SELECT * FROM master_table” is a good start.

withinboredom 4y ago
Have you seen the “turn your database into a graphql schema” products? I shudder at the poor souls who used those products. I mean, I assume they are decent products, but man, it’s got to be so easy to screw it up and literally expose too much…
- throwawaymaths 4y ago
  Hasura seems to be fine which we use internally in our company, though to be honest I don't do any complex queries and I don't think anyone is doing aggressively nested joins.
  - acdha 4y ago
    I think that can be part of the problem: if you use it for a few things which make sense, you get used to it and everyone thinks it's pretty solid after a while and probably starts using and likely exposing it in other areas. Then you get someone new writing different code or a clever attacker and it turns out there was a lot of room to expose unintended data or create performance issues.
    - throwawaymaths 4y ago
      I don't think hasura allows unbounded queries by default? I'm not 100% sure though, I didn't set it up at where I work.
stickfigure 4y ago
It's actually worse than that, because with graphql you can create a single query which is the moral equivalent of: SELECT * FROM master_table LEFT JOIN sub_table LEFT JOIN sub_sub_table LEFT_JOIN sub_sub_sub_table... ...which is effectively "dump everything". In a REST environment you'll at least need a lot more individual requests - that's both the blessing and curse.

lazyasciiart 4y ago

https://payatu.com/blog/manmeet/graphql-exploitation-part-4 https://payatu.com/blog/manmeet/graphql-exploitation-part-4 query dos { allDogs(onlyFree: false, limit: 1000000) { id veterinary { id dogs { id veterinary { id dogs { id veterinary { id dogs { .....