rohit/probo
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Bound GraphQL request cost to prevent alias-flooding DoS

Browse Source 
The GraphQL endpoint built its gqlgen server with bare handler.New and
no limits, so a single request with thousands of aliased resolver calls
was parsed, validated, executed, and marshalled in full. Under load this
let an unauthenticated client drive excessive CPU and memory use against
POST /api/connect/v1/graphql and the console and trust endpoints, which
share the same constructor (GHSA-prh2-g8pv-m7p9).

Add configurable guards in the shared gqlutils.NewHandler: a parser
token limit rejects oversized queries at lex time before any execution,
a fixed complexity limit caps field-selection count, an LRU query cache
avoids repeated parsing, and field suggestions are disabled. The limits
flow from a new APIConfig.GraphQL section through server and api config
into all three GraphQL handlers, with PROBOD_API_GRAPHQL_* env vars and
Helm values exposed for per-environment tuning.

Defaults are sized with generous headroom over real traffic: the parser
token limit (15000) and complexity limit (2000) sit far above the
largest legitimate frontend query yet well below the proof-of-concept
flood, so normal usage is unaffected while floods are rejected cheaply.

Signed-off-by: Bryan Frimin <bryan@probo.com>
This commit is contained in:
Bryan Frimin
2026-06-29 17:38:16 +02:00
parent 9f9ace2cb8
commit bf255b198c
18 changed files with 127 additions and 10 deletions
Download Patch File Download Diff File Expand all files Collapse all files

5
pkg/server/api/api.go
View File

@@ -47,6 +47,7 @@ import (
mcp_v1 "go.probo.inc/probo/pkg/server/api/mcp/v1"
slack_v1 "go.probo.inc/probo/pkg/server/api/slack/v1"
trust_v1 "go.probo.inc/probo/pkg/server/api/trust/v1"
"go.probo.inc/probo/pkg/server/gqlutils"
"go.probo.inc/probo/pkg/slack"
"go.probo.inc/probo/pkg/thirdparty"
"go.probo.inc/probo/pkg/trust"
@@ -75,6 +76,7 @@ type (
ConnectorRegistry *connector.ConnectorRegistry
ProviderRegistry *provider.Registry
CustomDomainCname string
GraphQLLimits gqlutils.Limits
Logger *log.Logger
}
@@ -188,6 +190,7 @@ func NewServer(cfg Config) (*Server, error) {
cfg.Cookie,
cfg.TokenSecret,
cfg.BaseURL,
cfg.GraphQLLimits,
),
consoleHandler: console_v1.NewMux(
cfg.Logger.Named("console.v1"),
@@ -208,6 +211,7 @@ func NewServer(cfg Config) (*Server, error) {
cfg.CustomDomainCname,
cfg.ThirdParty,
cfg.RiskManagement,
cfg.GraphQLLimits,
),
cookieBannerHandler: cookiebanner_v1.NewMux(
cfg.Logger.Named("cookiebanner.v1"),
@@ -261,6 +265,7 @@ func NewServer(cfg Config) (*Server, error) {
_, err := cfg.Trust.GetByDomainName(ctx, host)
return err == nil
},
cfg.GraphQLLimits,
),
}, nil
}

4
pkg/server/api/connect/v1/graphql_handler.go
View File

@@ -30,7 +30,7 @@ import (
"go.probo.inc/probo/pkg/server/gqlutils/directives/session"
)
func NewGraphQLHandler(svc *iam.Service, logger *log.Logger, fileManagerSvc *filemanager.Service, baseURL *baseurl.BaseURL, cookieConfig securecookie.Config) http.Handler {
func NewGraphQLHandler(svc *iam.Service, logger *log.Logger, fileManagerSvc *filemanager.Service, baseURL *baseurl.BaseURL, cookieConfig securecookie.Config, limits gqlutils.Limits) http.Handler {
config := schema.Config{
Resolvers: &Resolver{
authorize: authz.NewAuthorizeFunc(svc, logger),
@@ -49,7 +49,7 @@ func NewGraphQLHandler(svc *iam.Service, logger *log.Logger, fileManagerSvc *fil
}
es := schema.NewExecutableSchema(config)
gqlh := gqlutils.NewHandler(es, logger)
gqlh := gqlutils.NewHandler(es, logger, limits)
return gqlh
}

4
pkg/server/api/connect/v1/resolver.go
View File

@@ -46,6 +46,7 @@ import (
"go.probo.inc/probo/pkg/server/api/authn"
"go.probo.inc/probo/pkg/server/api/authz"
"go.probo.inc/probo/pkg/server/api/connect/v1/types"
"go.probo.inc/probo/pkg/server/gqlutils"
)
type (
@@ -70,6 +71,7 @@ func NewMux(
baseURL *baseurl.BaseURL,
allowedRedirectHost saferedirect.AllowedHostFunc,
isTrustCenterDomain IsTrustCenterDomainFunc,
graphqlLimits gqlutils.Limits,
) *chi.Mux {
r := chi.NewMux()
@@ -77,7 +79,7 @@ func NewMux(
apiKeyMiddleware := authn.NewAPIKeyMiddleware(svc, tokenSecret)
oauth2Middleware := authn.NewOAuth2AccessTokenMiddleware(svc)
identityPresenceMiddleware := authn.NewIdentityPresenceMiddleware(baseURL)
graphqlHandler := NewGraphQLHandler(svc, logger, fileManagerSvc, baseURL, cookieConfig)
graphqlHandler := NewGraphQLHandler(svc, logger, fileManagerSvc, baseURL, cookieConfig, graphqlLimits)
samlHandler := NewSAMLHandler(svc, cookieConfig, baseURL, logger)
scimHandler := NewSCIMHandler(svc, logger.Named("scim"))

3
pkg/server/api/console/v1/graphql_handler.go
View File

@@ -55,6 +55,7 @@ func NewGraphQLHandler(
riskManagementSvc *riskmanagement.Service,
fileManagerSvc *filemanager.Service,
baseURL *baseurl.BaseURL,
limits gqlutils.Limits,
) http.Handler {
config := schema.Config{
Resolvers: &Resolver{
@@ -80,7 +81,7 @@ func NewGraphQLHandler(
}
es := schema.NewExecutableSchema(config)
gqlh := gqlutils.NewHandler(es, logger)
gqlh := gqlutils.NewHandler(es, logger, limits)
return gqlh
}

3
pkg/server/api/console/v1/resolver.go
View File

@@ -47,6 +47,7 @@ import (
"go.probo.inc/probo/pkg/server/api/authz"
"go.probo.inc/probo/pkg/server/api/console/v1/dataloader"
"go.probo.inc/probo/pkg/server/api/console/v1/types"
"go.probo.inc/probo/pkg/server/gqlutils"
"go.probo.inc/probo/pkg/thirdparty"
)
@@ -92,6 +93,7 @@ func NewMux(
customDomainCname string,
thirdPartySvc *thirdparty.Service,
riskManagementSvc *riskmanagement.Service,
graphqlLimits gqlutils.Limits,
) *chi.Mux {
r := chi.NewMux()
@@ -114,6 +116,7 @@ func NewMux(
riskManagementSvc,
fileManagerSvc,
baseURL,
graphqlLimits,
)
r.Group(func(r chi.Router) {

3
pkg/server/api/trust/v1/graphql_handler.go
View File

@@ -44,6 +44,7 @@ func NewGraphQLHandler(
baseURL *baseurl.BaseURL,
cookieConfig securecookie.Config,
tokenSecret string,
limits gqlutils.Limits,
) http.Handler {
config := schema.Config{
Resolvers: &Resolver{
@@ -65,7 +66,7 @@ func NewGraphQLHandler(
}
es := schema.NewExecutableSchema(config)
gqlh := gqlutils.NewHandler(es, logger)
gqlh := gqlutils.NewHandler(es, logger, limits)
return gqlh
}

3
pkg/server/api/trust/v1/resolver.go
View File

@@ -46,6 +46,7 @@ import (
"go.probo.inc/probo/pkg/securecookie"
"go.probo.inc/probo/pkg/server/api/authn"
"go.probo.inc/probo/pkg/server/api/compliancepage"
"go.probo.inc/probo/pkg/server/gqlutils"
"go.probo.inc/probo/pkg/trust"
)
@@ -85,6 +86,7 @@ func NewMux(
cookieConfig securecookie.Config,
tokenSecret string,
baseURL *baseurl.BaseURL,
graphqlLimits gqlutils.Limits,
) *chi.Mux {
r := chi.NewMux()
@@ -112,6 +114,7 @@ func NewMux(
baseURL,
cookieConfig,
tokenSecret,
graphqlLimits,
)
r.Group(

36
pkg/server/gqlutils/handler.go
View File

@@ -21,13 +21,27 @@ import (
"github.com/99designs/gqlgen/graphql"
"github.com/99designs/gqlgen/graphql/handler"
"github.com/99designs/gqlgen/graphql/handler/extension"
"github.com/99designs/gqlgen/graphql/handler/lru"
"github.com/99designs/gqlgen/graphql/handler/transport"
"github.com/vektah/gqlparser/v2/ast"
"go.gearno.de/kit/log"
)
type Handler struct {
gqlhandler *handler.Server
}
type (
Handler struct {
gqlhandler *handler.Server
}
// Limits bounds the per-request cost of a GraphQL operation to protect
// against alias-flooding and other application-layer denial-of-service
// vectors. A zero value disables the corresponding guard.
Limits struct {
ParserTokenLimit int
ComplexityLimit int
QueryCacheSize int
DisableSuggestion bool
}
)
var (
mb int64 = 1024 * 1024
@@ -42,13 +56,27 @@ var (
introspectionExtension = extension.Introspection{}
)
func NewHandler[S graphql.ExecutableSchema](executableSchema S, logger *log.Logger) *Handler {
func NewHandler[S graphql.ExecutableSchema](executableSchema S, logger *log.Logger, limits Limits) *Handler {
handler := handler.New(executableSchema)
handler.AddTransport(postTransport)
handler.AddTransport(optionsTransport)
handler.AddTransport(multipartTransport)
if limits.QueryCacheSize > 0 {
handler.SetQueryCache(lru.New[*ast.QueryDocument](limits.QueryCacheSize))
}
if limits.ParserTokenLimit > 0 {
handler.SetParserTokenLimit(limits.ParserTokenLimit)
}
if limits.ComplexityLimit > 0 {
handler.Use(extension.FixedComplexityLimit(limits.ComplexityLimit))
}
handler.SetDisableSuggestion(limits.DisableSuggestion)
handler.Use(introspectionExtension)
handler.Use(NewTracingExtension(logger))

3
pkg/server/server.go
View File

@@ -42,6 +42,7 @@ import (
"go.probo.inc/probo/pkg/securecookie"
"go.probo.inc/probo/pkg/server/api"
"go.probo.inc/probo/pkg/server/api/compliancepage"
"go.probo.inc/probo/pkg/server/gqlutils"
"go.probo.inc/probo/pkg/server/mailactions"
trust_web "go.probo.inc/probo/pkg/server/trust"
console_web "go.probo.inc/probo/pkg/server/web"
@@ -74,6 +75,7 @@ type Config struct {
ConnectorRegistry *connector.ConnectorRegistry
ProviderRegistry *provider.Registry
CustomDomainCname string
GraphQLLimits gqlutils.Limits
Logger *log.Logger
}
@@ -114,6 +116,7 @@ func NewServer(cfg Config) (*Server, error) {
ConnectorRegistry: cfg.ConnectorRegistry,
ProviderRegistry: cfg.ProviderRegistry,
CustomDomainCname: cfg.CustomDomainCname,
GraphQLLimits: cfg.GraphQLLimits,
Logger: cfg.Logger.Named("api"),
}