GHSA-fj3h-2jc3-973v: 
Rust vulnerability analysis and mitigation

Impact

The make_graphql_filter() and make_graphql_filter_sync() filters of juniper_warp read the whole body of a POST request into memory before they parse the body. The filters had no limit on the size of the body. A client could thus send a large body and exhaust the memory of the server. The request needs no authentication. Bodies of all content types were affected.

Patches

juniper_warp 0.9.1 reads at most 2 MiB of a request body by default. The filters respond with 413 Payload Too Large to larger bodies. The filters stop reading a body as soon as the body exceeds the limit. make_graphql_filter_with_body_limit() and make_graphql_filter_sync_with_body_limit() set another limit.

Workarounds

Put warp::body::content_length_limit() in front of the filter for requests other than GET. The content_length_limit() filter rejects requests with a large Content-Length header and requests without the header. GET requests carry the query in the URL and have no body.

let body_limit = warp::get()
    .or(warp::body::content_length_limit(2 * 1024 * 1024))
    .unify();
let graphql = warp::path("graphql")
    .and(body_limit)
    .and(juniper_warp::make_graphql_filter(schema, context_extractor));

References

• Changelog of juniper_warp 0.9.1
• Changes from 0.9.0 to 0.9.1
• GHSA-pfrg-qg4f-grmv describes the same issue in juniper_hyper.