Security/CWE 200 graphql introspection toggle (#10531)

Co-authored-by: Erik Kvale <ekvale@vivsoft.io>
datahub-project · May 17, 2024 · f5a252c · f5a252c
1 parent ebdcc25
commit f5a252c
Show file tree

Hide file tree

Showing 4 changed files with 22 additions and 3 deletions.
diff --git a/datahub-graphql-core/src/main/java/com/linkedin/datahub/graphql/GmsGraphQLEngine.java b/datahub-graphql-core/src/main/java/com/linkedin/datahub/graphql/GmsGraphQLEngine.java
@@ -497,6 +497,7 @@ public class GmsGraphQLEngine {
 
   private final int graphQLQueryComplexityLimit;
   private final int graphQLQueryDepthLimit;
+  private final boolean graphQLQueryIntrospectionEnabled;
 
   private final BusinessAttributeType businessAttributeType;
 
@@ -612,6 +613,7 @@ public GmsGraphQLEngine(final GmsGraphQLEngineArgs args) {
 
     this.graphQLQueryComplexityLimit = args.graphQLQueryComplexityLimit;
     this.graphQLQueryDepthLimit = args.graphQLQueryDepthLimit;
+    this.graphQLQueryIntrospectionEnabled = args.graphQLQueryIntrospectionEnabled;
 
     this.businessAttributeType = new BusinessAttributeType(entityClient);
     // Init Lists
@@ -819,7 +821,8 @@ public GraphQLEngine.Builder builder() {
         .addDataLoader("Aspect", context -> createDataLoader(aspectType, context))
         .configureRuntimeWiring(this::configureRuntimeWiring)
         .setGraphQLQueryComplexityLimit(graphQLQueryComplexityLimit)
-        .setGraphQLQueryDepthLimit(graphQLQueryDepthLimit);
+        .setGraphQLQueryDepthLimit(graphQLQueryDepthLimit)
+        .setGraphQLQueryIntrospectionEnabled(graphQLQueryIntrospectionEnabled);
     return builder;
   }
 

diff --git a/datahub-graphql-core/src/main/java/com/linkedin/datahub/graphql/GmsGraphQLEngineArgs.java b/datahub-graphql-core/src/main/java/com/linkedin/datahub/graphql/GmsGraphQLEngineArgs.java
@@ -82,6 +82,7 @@ public class GmsGraphQLEngineArgs {
   RestrictedService restrictedService;
   int graphQLQueryComplexityLimit;
   int graphQLQueryDepthLimit;
+  boolean graphQLQueryIntrospectionEnabled;
   BusinessAttributeService businessAttributeService;
 
   // any fork specific args should go below this line

diff --git a/datahub-graphql-core/src/main/java/com/linkedin/datahub/graphql/GraphQLEngine.java b/datahub-graphql-core/src/main/java/com/linkedin/datahub/graphql/GraphQLEngine.java
@@ -16,6 +16,7 @@
 import graphql.schema.idl.SchemaGenerator;
 import graphql.schema.idl.SchemaParser;
 import graphql.schema.idl.TypeDefinitionRegistry;
+import graphql.schema.visibility.NoIntrospectionGraphqlFieldVisibility;
 import java.util.ArrayList;
 import java.util.HashMap;
 import java.util.List;
@@ -44,15 +45,18 @@ public class GraphQLEngine {
   private final Map<String, Function<QueryContext, DataLoader<?, ?>>> _dataLoaderSuppliers;
   private final int graphQLQueryComplexityLimit;
   private final int graphQLQueryDepthLimit;
+  private final boolean graphQLQueryIntrospectionEnabled;
 
   private GraphQLEngine(
       @Nonnull final List<String> schemas,
       @Nonnull final RuntimeWiring runtimeWiring,
       @Nonnull final Map<String, Function<QueryContext, DataLoader<?, ?>>> dataLoaderSuppliers,
       @Nonnull final int graphQLQueryComplexityLimit,
-      @Nonnull final int graphQLQueryDepthLimit) {
+      @Nonnull final int graphQLQueryDepthLimit,
+      @Nonnull final boolean graphQLQueryIntrospectionEnabled) {
     this.graphQLQueryComplexityLimit = graphQLQueryComplexityLimit;
     this.graphQLQueryDepthLimit = graphQLQueryDepthLimit;
+    this.graphQLQueryIntrospectionEnabled = graphQLQueryIntrospectionEnabled;
 
     _dataLoaderSuppliers = dataLoaderSuppliers;
 
@@ -130,6 +134,7 @@ public static class Builder {
     private final RuntimeWiring.Builder _runtimeWiringBuilder = newRuntimeWiring();
     private int graphQLQueryComplexityLimit = 2000;
     private int graphQLQueryDepthLimit = 50;
+    private boolean graphQLQueryIntrospectionEnabled = true;
 
     /**
      * Used to add a schema file containing the GQL types resolved by the engine.
@@ -177,6 +182,9 @@ public Builder addDataLoaders(
      * any required data + type resolvers.
      */
     public Builder configureRuntimeWiring(final Consumer<RuntimeWiring.Builder> builderFunc) {
+      if (!this.graphQLQueryIntrospectionEnabled)
+        _runtimeWiringBuilder.fieldVisibility(
+            NoIntrospectionGraphqlFieldVisibility.NO_INTROSPECTION_FIELD_VISIBILITY);
       builderFunc.accept(_runtimeWiringBuilder);
       return this;
     }
@@ -191,14 +199,20 @@ public Builder setGraphQLQueryDepthLimit(final int queryDepthLimit) {
       return this;
     }
 
+    public Builder setGraphQLQueryIntrospectionEnabled(final boolean introspectionEnabled) {
+      this.graphQLQueryIntrospectionEnabled = introspectionEnabled;
+      return this;
+    }
+
     /** Builds a {@link GraphQLEngine}. */
     public GraphQLEngine build() {
       return new GraphQLEngine(
           _schemas,
           _runtimeWiringBuilder.build(),
           _loaderSuppliers,
           graphQLQueryComplexityLimit,
-          graphQLQueryDepthLimit);
+          graphQLQueryDepthLimit,
+          graphQLQueryIntrospectionEnabled);
     }
   }
 

diff --git a/metadata-service/configuration/src/main/resources/application.yaml b/metadata-service/configuration/src/main/resources/application.yaml
@@ -443,6 +443,7 @@ graphQL:
   query:
     complexityLimit: ${GRAPHQL_QUERY_COMPLEXITY_LIMIT:2000}
     depthLimit: ${GRAPHQL_QUERY_DEPTH_LIMIT:50}
+    introspectionEnabled: ${GRAPHQL_QUERY_INTROSPECTION_ENABLED:true}
 
 springdoc.api-docs.groups.enabled: true