Re:GraphQL kinda sucks
by lazyasciiart on Saturday August 06, 2022 @03:16PM
(#32370774)
https://payatu.com/blog/manmeet/graphql-exploitation-part-4
query dos { allDogs(onlyFree: false, limit: 1000000) { id veterinary { id dogs { id veterinary { id dogs { id veterinary { id dogs { .....
Details will depend on your schema, but the moral equivalent of “SELECT * FROM master_table” is a good start.
Re:GraphQL kinda sucks
by withinboredom on Saturday August 06, 2022 @04:18PM
(#32371230)
Have you seen the “turn your database into a graphql schema” products? I shudder at the poor souls who used those products. I mean, I assume they are decent products, but man, it’s got to be so easy to screw it up and literally expose too much…
Re:GraphQL kinda sucks
by throwawaymaths on Saturday August 06, 2022 @06:29PM
(#32372181)
Hasura seems to be fine which we use internally in our company, though to be honest I don't do any complex queries and I don't think anyone is doing aggressively nested joins.
I think that can be part of the problem: if you use it for a few things which make sense, you get used to it and everyone thinks it's pretty solid after a while and probably starts using and likely exposing it in other areas. Then you get someone new writing different code or a clever attacker and it turns out there was a lot of room to expose unintended data or create performance issues.
Re:GraphQL kinda sucks
by throwawaymaths on Sunday August 07, 2022 @11:04AM
(#32377032)
I don't think hasura allows unbounded queries by default? I'm not 100% sure though, I didn't set it up at where I work.
Re:GraphQL kinda sucks
by stickfigure on Sunday August 07, 2022 @01:10AM
(#32374063)
It's actually worse than that, because with graphql you can create a single query which is the moral equivalent of:
SELECT * FROM master_table LEFT JOIN sub_table LEFT JOIN sub_sub_table LEFT_JOIN sub_sub_sub_table...
...which is effectively "dump everything". In a REST environment you'll at least need a lot more individual requests - that's both the blessing and curse.
Can you give an example?