René's URL Explorer Experiment

Title: READY - Stop DOS attacks by making the lexer stop early on evil input. by bbakerman · Pull Request #2892 · graphql-java/graphql-java · GitHub

Open Graph Title: READY - Stop DOS attacks by making the lexer stop early on evil input. by bbakerman · Pull Request #2892 · graphql-java/graphql-java

X Title: READY - Stop DOS attacks by making the lexer stop early on evil input. by bbakerman · Pull Request #2892 · graphql-java/graphql-java

Description: This is related to #2888 The bug was that we do indeed have a max token counting mechanism in graphql-java BUt it was being enacted too late. Testing showed that the max token code was indeed being hit BUT the ANTLR lexing and parsing code was taking proportionally longer to get to the max token state as the input size increased This is cause bv the greedy nature of the ANTLR Lexer - it will look ahead and store tokens in memory under certain grammar conditions and butted directives like @lol@lol are one of them. This meant that the lexer was the code contributing to CPU time and not the parser - BUT the max token code check was in the parser. This PR puts the same max token checks on the lexer as it does in the parser. In fact it debatable if the parser checks should still be retained (since the lexer will be the main way this will be hit) but the logic is common so I left it in place. The current existing billion @lols test still parse with this change - The difference is where cancel parse exception is being thrown. The use of the lexer as the place to count means the counting checks are done in constant time. As soon as the max tokens is encountered, the parse is stopped. graphql-java also uses 3 channels for tokens (0 for the grammar and 2 and 3 for comments and whitespace). The lexing of whitespace and comments also take up CPU time so they counters have been put in place to watch tokens on those channels as well. This will stop a "mostly whitespace" attack, even though whitespace costs less to aggregate in practice

Open Graph Description: This is related to #2888 The bug was that we do indeed have a max token counting mechanism in graphql-java BUt it was being enacted too late. Testing showed that the max token code was indeed being...

X Description: This is related to #2888 The bug was that we do indeed have a max token counting mechanism in graphql-java BUt it was being enacted too late. Testing showed that the max token code was indeed being...

Opengraph URL: https://github.com/graphql-java/graphql-java/pull/2892

X: @github

direct link

Domain: github.com

Links:

Viewport: width=device-width