GHSA-34cw-x8g7-rcv5: 
Rust vulnerability analysis and mitigation

Impact

The parser of juniper calls itself once for each level of nesting in a GraphQL document. The parser had no limit on the nesting depth. Deeply nested selection sets, input values, and list types thus overflowed the stack of the thread that parsed the document. Validation and execution follow fragment spreads in the same recursive way. Long chains of fragment spreads thus overflowed the stack in validation and execution. A stack overflow aborts the whole process. std::panic::catch_unwind() cannot catch the abort. One request can thus stop a server and drop all other requests in progress. The request needs no authentication. A document of about 11 KB overflows the 8 MiB stack of the main thread on Linux. Threads with smaller stacks overflow on smaller documents.

Patches

juniper 0.17.2 rejects documents that nest deeper than 64 levels. Each selection set, list value, object value, and list type adds a level. The selection set of a fragment counts at the depth of each spread of the fragment. The parser reports a document over the limit with ParseError::DepthLimitExceeded. RootNode::limit_depth() changes the limit. juniper 0.17.2 also rejects documents with more than 15,000 tokens. RootNode::limit_tokens() changes the token limit.

Workarounds

No reliable workaround exists for earlier versions. A small limit on the size of request bodies makes the attack harder. Such a limit also rejects large legitimate documents.

References

• Changelog of juniper 0.17.2
• Changes from 0.17.1 to 0.17.2
• GHSA-36rq-8957-mjrx lists other denial-of-service issues that the same release fixes.
• GHSA-4rx6-g5vg-5f3j fixed the stack overflow on cycles of fragment spreads in 0.15.10. The fragment chains of this advisory have no cycles.