Skip to content

graphql: Missing query complexity and alias bounds on repos field #428

Open
Open
graphql: Missing query complexity and alias bounds on repos field#428
Labels
crate:nodegitlawb-node — the serving node and REST APIkind:securityVulnerability fix or hardeningsev:highMajor break or real security/trust risk, no easy workaroundsubsystem:apiNode REST API request/response surface

Description

@euxaristia
euxaristia
opened on Sep 10, 2026

Summary

POST /graphql accepts anonymous queries without depth, alias, or complexity limits (crates/gitlawb-node/src/graphql/mod.rs:79-88). Each aliased repos root field executes two unpaginated database queries (crates/gitlawb-node/src/graphql/query.rs:12-45).

Impact

One request with many aliased root fields multiplies database queries and heap allocations.

Remediation

  1. Enforce query complexity and alias limits before execution.
  2. Paginate repository results.
  3. Batch visibility lookups."

Activity

  1. beardthelion
    added
    crate:nodegitlawb-node — the serving node and REST API
    kind:securityVulnerability fix or hardening
    sev:highMajor break or real security/trust risk, no easy workaround
    subsystem:apiNode REST API request/response surface
    subsystem:visibilityPath-scoped visibility and content withholding
    and removed
    subsystem:visibilityPath-scoped visibility and content withholding
    on Sep 10, 2026

  2. beardthelion commented on Sep 10, 2026

    @beardthelion
    beardthelion
    on Sep 10, 2026
    Collaborator

    PR #408 implements this (document complexity cap, depth limit, per-root cost so aliases consume the budget). It predates this issue; linking here so the merge can close it.

  3. euxaristia
    added 2 commits that reference this issue on Sep 20, 2026

    fix(db): deny malformed reader lists without failing repo pages

    c0aa2dc

    fix(graphql): reject NUL bytes in repository cursors

    a80845e
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Metadata

Metadata

Assignees

No one assigned

    Labels

    crate:nodegitlawb-node — the serving node and REST APIkind:securityVulnerability fix or hardeningsev:highMajor break or real security/trust risk, no easy workaroundsubsystem:apiNode REST API request/response surface

    Type

    No type

    Projects

    No projects

      Milestone

      No milestone

      Relationships

      None yet

      Development

      No branches or pull requests

      Issue actions