Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Address async-graphql vulnerability #2290

Merged
merged 12 commits into from
Oct 4, 2024
Merged

Address async-graphql vulnerability #2290

merged 12 commits into from
Oct 4, 2024

Conversation

MitchTurner
Copy link
Member

@MitchTurner MitchTurner commented Oct 4, 2024 •
edited
Loading

Linked Issues/PRs

GHSA-5gc2-7c65-8fq8

Description

Our code only uses "directives" in one place inside schema.sdl:

directive @include(if: Boolean!) on FIELD | FRAGMENT_SPREAD | INLINE_FRAGMENT
directive @skip(if: Boolean!) on FIELD | FRAGMENT_SPREAD | INLINE_FRAGMENT
schema {
	query: Query
	mutation: Mutation
	subscription: Subscription
}

Reading the cynic documentation:

The following features are not yet supported, though should be soon (if you want to help out with the project I'd be happy for someone else to try and implement these - if you open an issue I'd be happy to give pointers on how to go about implementing any of them)

   - Directives
   - Potentially other things (please open an issue if you find anything obviously missing)

So the rust client doesn't even support the directives.

We use graphql-request on the TS side. On a quick glance, it seems they do support directives to some extent, but I don't know if that means we should support them on the server side.

I've set an arbitrary limit of 100 for now. Even that might be high; I'm still getting familiar with when these directives come into play. We can also consider making it configurable too.

Before requesting review

  • I have reviewed the code myself

@MitchTurner MitchTurner added the no changelog Skip the CI check of the changelog modification label Oct 4, 2024
@MitchTurner MitchTurner self-assigned this Oct 4, 2024
@MitchTurner MitchTurner marked this pull request as ready for review October 4, 2024 12:36
xgreenx
xgreenx reviewed Oct 4, 2024
View reviewed changes
crates/fuel-core/Cargo.toml Outdated
@@ -12,7 +12,7 @@ version = { workspace = true }

[dependencies]
anyhow = { workspace = true }
async-graphql = { version = "7.0.6", features = [
async-graphql = { version = "7.0.10", features = [
Copy link
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Suggested change
async-graphql = { version = "7.0.10", features = [
async-graphql = { version = "7.0.11", features = [

crates/fuel-core/src/schema.rs Outdated
Schema::build_with_ignore_name_conflicts(
Query::default(),
Mutation::default(),
Subscription::default(),
["TransactionConnection", "MessageConnection"],
)
.limit_directives(ARB_DIRECTIVES_LIMIT)
Copy link
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

We set all limits in another place.

image

Could you also add a CLI argument to allow control over that, please?=)

@xgreenx xgreenx changed the base branch from release/v0.36.0 to master October 4, 2024 20:34
@xgreenx
Merge branch 'refs/heads/master' into chore/bump-async-graphql-version-2
f8bed28 
# Conflicts:
#	Cargo.lock
#	Cargo.toml
#	bin/fuel-core/chainspec/local-testnet/state_transition_bytecode.wasm
@xgreenx
Apply comments from the PR
a130b39
@xgreenx
Updated CHANGELOG.md
3633655
@MitchTurner MitchTurner merged commit a932dad into master Oct 4, 2024
38 checks passed
@MitchTurner MitchTurner deleted the chore/bump-async-graphql-version-2 branch October 4, 2024 22:29
@xgreenx xgreenx mentioned this pull request Oct 5, 2024
Merged
xgreenx added a commit that referenced this pull request Oct 5, 2024
@xgreenx
Release v0.37.0 (#2302)
d4ffb2e 
## Version v0.37.0

### Added
- [1609](#1609): Add DA
compression support. Compressed blocks are stored in the offchain
database when blocks are produced, and can be fetched using the GraphQL
API.
- [2290](#2290): Added a new
CLI argument `--graphql-max-directives`. The default value is `10`.
- [2195](#2195): Added
enforcement of the limit on the size of the L2 transactions per block
according to the `block_transaction_size_limit` parameter.
- [2131](#2131): Add flow in
TxPool in order to ask to newly connected peers to share their
transaction pool
- [2182](#2151): Limit number
of transactions that can be fetched via TxSource::next
- [2189](#2151): Select next
DA height to never include more than u16::MAX -1 transactions from L1.
- [2162](#2162): Pool
structure with dependencies, etc.. for the next transaction pool module.
Also adds insertion/verification process in PoolV2 and tests refactoring
- [2265](#2265): Integrate
Block Committer API for DA Block Costs.
- [2280](#2280): Allow comma
separated relayer addresses in cli
- [2299](#2299): Support blobs
in the predicates.
- [2300](#2300): Added new
function to `fuel-core-client` for checking whether a blob exists.

### Changed

#### Breaking
- [2299](#2299): Anyone who
wants to participate in the transaction broadcasting via p2p must
upgrade to support new predicates on the TxPool level.
- [2299](#2299): Upgraded
`fuel-vm` to `0.58.0`. More information in the
[release](https://github.com/FuelLabs/fuel-vm/releases/tag/v0.58.0).
- [2276](#2276): Changed how
complexity for blocks is calculated. The default complexity now is
80_000. All queries that somehow touch the block header now are more
expensive.
- [2290](#2290): Added a new
GraphQL limit on number of `directives`. The default value is `10`.
- [2206](#2206): Use timestamp
of last block when dry running transactions.
- [2153](#2153): Updated
default gas costs for the local testnet configuration to match
`fuel-core 0.35.0`.

## What's Changed
* fix: use core-test.fuellabs.net for dnsaddr resolution by @rymnc in
#2214
* Removed state transition bytecode from the local testnet by @xgreenx
in #2215
* Send whole transaction pool upon subscription to gossip by @AurelienFT
in #2131
* Update default gas costs based on 0.35.0 benchmarks by @xgreenx in
#2153
* feat: Use timestamp of last block when dry running transactions by
@netrome in #2206
* fix(dnsaddr_resolution): use fqdn separator to prevent suffixing by
dns resolvers by @rymnc in
#2222
* TransactionSource: specify maximum number of transactions to be
fetched by @acerone85 in #2182
* Implement worst case scenario for price algorithm v1 by @rafal-ch in
#2219
* chore(gas_price_service): define port for L2 data by @rymnc in
#2224
* Block producer selects da height to never exceed u64::MAX - 1
transactions from L1 by @acerone85 in
#2189
* Weekly `cargo update` by @github-actions in
#2236
* Use fees to calculate DA reward and avoid issues with Gwei/Wei
conversions by @MitchTurner in
#2229
* Protect against passing `i128::MIN` to `abs()` which causes overflow
by @rafal-ch in #2241
* Acquire `da_finalization_period` from the command line by @rafal-ch in
#2240
* Executor: test Tx_count limit with incorrect tx source by @acerone85
in #2242
* Minor updates to docs + a few typos fixed by @rafal-ch in
#2250
* chore(gas_price_service): move algorithm_updater to
fuel-core-gas-price-service by @rymnc in
#2246
* Use single heavy input in the `transaction_throughput.rs` benchmarks
by @xgreenx in #2205
* Enforce the block size limit by @rafal-ch in
#2195
* feat: build ARM and AMD in parallel by @mchristopher in
#2130
* Weekly `cargo update` by @github-actions in
#2268
* chore(gas_price_service): split into v0 and v1 and squash
FuelGasPriceUpdater type into GasPriceService by @rymnc in
#2256
* feat(gas_price_service): update block committer da source with
established contract by @rymnc in
#2265
* Use bytes from `unrecorded_blocks` rather from the block from DA by
@MitchTurner in #2252
* TxPool v2 General architecture by @AurelienFT in
#2162
* Add value delimiter and tests args by @AurelienFT in
#2280
* fix(da_block_costs): remove Arc<Mutex<>> on shared_state and expose
channel by @rymnc in #2278
* fix(combined_database): syncing auxiliary databases on startup with
custom behaviour by @rymnc in
#2272
* fix: Manually encode Authorization header for eventsource_client by
@Br1ght0ne in #2284
* Address `async-graphql` vulnerability by @MitchTurner in
#2290
* Update the WASM compatibility tests for `0.36` release by @rafal-ch in
#2271
* DA compression by @Dentosal in
#1609
* Use different port for every version compatibility test by @rafal-ch
in #2301
* Fix block query complexity by @xgreenx in
#2297
* Support blobs in predicates by @Voxelot in
#2299


**Full Changelog**:
v0.36.0...v0.37.0
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Reviewers

@xgreenx xgreenx xgreenx approved these changes

@AurelienFT AurelienFT AurelienFT approved these changes

@Dentosal Dentosal Awaiting requested review from Dentosal Dentosal is a code owner

Assignees

@MitchTurner MitchTurner

Labels
no changelog Skip the CI check of the changelog modification
Projects
None yet
Milestone
No milestone
Development

Successfully merging this pull request may close these issues.
3 participants
@MitchTurner @xgreenx @AurelienFT