-
Notifications
You must be signed in to change notification settings - Fork 2.8k
Fixing vulnerability on Postgres DB handler that was exposing the database type #4294
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Fixing vulnerability on Postgres DB handler that was exposing the database type #4294
Conversation
… security vulnerability exposing database type
|
Beep boop! 🤖 Hey @franciscofsales, thanks for your PR! One of my human friends will review this PR and get back to you as soon as possible. Stay awesome! 😎 |
|
Review app for commit b43459c deployed to Heroku: https://hge-ci-pull-4294.herokuapp.com |
marionschleifer
left a comment
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Changelog approved.
|
Review app for commit 1316f0f deployed to Heroku: https://hge-ci-pull-4294.herokuapp.com |
|
Beep boop! 🤖 Awesome work @franciscofsales! All of us at Hasura ❤️ what you did. Thanks again 🤗 |
|
Review app https://hge-ci-pull-4294.herokuapp.com is deleted |
|
Review app for commit 2c34a8d deployed to Heroku: https://hge-ci-pull-4294.herokuapp.com |
Description
When using pagination on a query and using Hasura against postgres, if the users sends an invalid value for offset, example
"1-1", the returned error ispostgres query error. Exposing to the external world the database system being used. Changed the postgres specific error message to a generic database query error - no longer exposing database type.Changelog
CHANGELOG.mdis updated with user-facing content relevant to this PR.Affected components
Related Issues
Solution and Design
Simply replace with a generic
databasemention.Steps to test and verify
"1-1"- get an error that no longer refers postgresLimitations, known bugs & workarounds
Nothing.
Server checklist
Nothing.
Catalog upgrade
Does this PR change Hasura Catalog version?
Metadata
Does this PR add a new Metadata feature?
run_sqlauto manages the new metadata through schema diffing?run_sqlauto manages the definitions of metadata on renaming?export_metadata/replace_metadatasupports the new metadata added?GraphQL
Breaking changes
No Breaking changes
There are breaking changes:
Metadata API
Existing
querytypes:argspayload which is not backward compatibleJSONschemaGraphQL API
Schema Generation:
NamedTypeSchema Resolve:-
nullvalue for any input fieldsLogging
JSONschema has changedtypenames have changed