GHSA-36rq-8957-mjrx: 
Rust vulnerability analysis and mitigation

Impact

Several parts of juniper did work that grew faster than the size of the GraphQL document. A small document could thus use seconds of CPU time or gigabytes of memory. The requests need no authentication. Parallel requests can deny service to all other clients of a server.

• OverlappingFieldsCanBeMerged compared all pairs of fields with the same response name. Inline fragments add their fields to the fields of the parent selection set. A document of 364 KB with nested inline fragments took 5.8 seconds to validate. A document of 28 KB with one repeated field took 3 seconds to validate.
• OverlappingFieldsCanBeMerged reported one error for each pair of conflicting fields. A document of 25 KB produced 2.56 million errors. The errors used 1.2 GB of memory.
• NoFragmentCycles and OverlappingFieldsCanBeMerged visited a fragment again for each path that spread the fragment. Validation time thus doubled with each fragment that spread the next fragment twice. A document of 813 bytes took 0.66 seconds to validate.
• Execution resolved the fields of a fragment once for each spread of the fragment. A document of 1.2 KB with the same fragments expanded into a billion fields.
• The parser removed each token from the front of a vector. Parsing time thus grew with the square of the number of tokens. A document of 480 KB took 6 seconds to parse.

Patches

juniper 0.17.2 fixes the issues.

• The parser rejects documents with more than 15,000 tokens. RootNode::limit_tokens() changes the limit.
• The parser rejects operations with more than 15,000 fields after the expansion of fragments. RootNode::limit_fields() changes the limit.
• NoFragmentCycles and OverlappingFieldsCanBeMerged visit each fragment once.
• OverlappingFieldsCanBeMerged stops after 100,000 field comparisons and rejects the document as too complex. The rule reports at most 100 conflicts.
• The parser takes each token from a queue in constant time.

Workarounds

No reliable workaround exists for earlier versions. A limit on the size of request bodies cannot stop the exponential cases. A document of 1.2 KB is enough for a billion fields.

References

• Changelog of juniper 0.17.2
• Changes from 0.17.1 to 0.17.2
• GHSA-34cw-x8g7-rcv5 describes the stack overflow that the same release fixes.