Disable graphql-upload integration when it is not used #6476
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
✅ Deploy Preview for apollo-server-docs ready!
To edit notification comments on pull requests, go to your Netlify site settings. |
By default, we run the graphql-upload middleware on all requests. This middleware is vulnerable to mutation CSRF attacks because it parses POST requests with `content-type: multipart/form-data`, which can happen in a non-preflighted browser request. (Without graphql-upload, Apollo Server won't process any mutations in non-preflighted requests, because mutations must be in POST requests and normally that requires `content-type: application/json` which must be preflighted.) In order to safely use graphql-upload, you should upgrade to Apollo Server v3.7 and use its new CSRF prevention feature. Because Apollo Server 2 is not under active development we do not intend to backport the full CSRF prevention feature to AS2. However, we at least want to protect the users of Apollo Server 2 who *don't* actually need graphql-upload to be enabled (which is probably most of them). This PR changes the default behavior of Apollo Server 2 when no `uploads` parameter is passed. Instead of always executing the graphql-upload middleware in this case, we only execute it if the `Upload` scalar (which may be added automatically to the schema by AS itself or may be provided by the user) is referenced somewhere in the schema other than its own definition. This should be roughly backwards-compatible; it only breaks the ability to use a `graphql-upload`-based client with Apollo Servers that don't accept uploads. We also print a warning when uploads are enabled encouraging upgrades.
Sign up for free
to subscribe to this conversation on GitHub.
Already have an account?
Sign in.
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
By default, we run the graphql-upload middleware on all requests. This
middleware is vulnerable to mutation CSRF attacks because it parses POST
requests with
content-type: multipart/form-data, which can happen in anon-preflighted browser request. (Without graphql-upload, Apollo Server
won't process any mutations in non-preflighted requests, because
mutations must be in POST requests and normally that requires
content-type: application/jsonwhich must be preflighted.)In order to safely use graphql-upload, you should upgrade to Apollo
Server v3.7 and use its new CSRF prevention feature. Because Apollo
Server 2 is not under active development we do not intend to backport
the full CSRF prevention feature to AS2.
However, we at least want to protect the users of Apollo Server 2 who
don't actually need graphql-upload to be enabled (which is probably
most of them). This PR changes the default behavior of Apollo Server 2
when no
uploadsparameter is passed. Instead of always executing thegraphql-upload middleware in this case, we only execute it if the
Uploadscalar (which may be added automatically to the schema by ASitself or may be provided by the user) is referenced somewhere in the
schema other than its own definition. This should be roughly
backwards-compatible; it only breaks the ability to use a
graphql-upload-based client with Apollo Servers that don't acceptuploads.
We also print a warning when uploads are enabled encouraging upgrades.
Part of GHSA-2p3c-p3qw-69r4