[File Upload] - flawed error handling for bad JSON

[juona]

With "apollo-server-express": "^2.1.0".

I am testing my file upload API using a REST client (Insomnia). The Apollo Express Server delegates file upload handling to the Apollo Upload Server by Jayden Seric. This middleware handles multipart requests and requires a few HTTP headers to be set to work correctly. These headers ("operations" and "map") require JSON data. If I pass invalid JSON data to one of these headers, an unhandled exception is thrown asynchronously in the Upload Server thus killing the whole server!

I believe this issue to have been fixed in later releases of the Upload Server. The latest Apollo Express uses apollo-upload-server v5. The apollo-upload-server code has been migrated to graphql-upload and the current version is 8. There is a small change in the API, which I believe to be non-essential. It would be nice to have the dependency updated! : ]

Working on Windows I find forking the apollo-server repo and testing this change a bit of a nuisance but if required I could try to do it.

[AlpacaGoesCrazy]

could it be similar to #1419 ?

[juona]

Don't think so. #1419 seems specific to the lambda server.

There seems to be a bunch of other problems in the validation/error handling area of the old upload server version. E.g. sending JSON with invalid data can easily hang the request and at a glance the new version appears to address these issues.

[jaydenseric]

See also #1509 (comment)

[edevil]

Is this security issue reported somewhere? I think users should be aware of this issue when they are using apollo-server with file uploads. Maybe attach a CVE to @apollographql/apollo-upload-server so that "npm install" reports it?

[abernix]

This should be addressed by #2054. If you'd be willing to try that alpha release, as shared in #2054 (comment), I'd be happy to know that you'd had success with the upgrade.

I suspect it will fix this problem, so I'll go ahead and close this. Happy to reopen if you find that apollo-server-express@2.3.0-alpha.0 doesn't fix this problem for you!

Thanks for reporting this originally!

[abernix]

The alpha releases didn't identify any problems so I've graduated this to the official apollo-server-*@2.3.0 releases.