lordcheng10 opened a new issue, #14066:
URL: https://github.com/apache/apisix/issues/14066
### Current Behavior
`graphql-limit-count` and `graphql-proxy-cache` decode the POST body and
index the result without checking that it is a table:
```lua
local res, err = core.json.decode(body, {null_as_nil = true})
if not res then
return false, "invalid graphql request, " .. err
end
if not res[GRAPHQL_REQ_QUERY] then
```
`cjson` decodes any valid JSON document, not only objects. A body of `123`
decodes to a Lua number and `true` decodes to a boolean, both with `err ==
nil`,
so `res[GRAPHQL_REQ_QUERY]` indexes a scalar and raises an uncaught Lua error
in the access phase. The request is answered with HTTP 500 instead of the 400
the plugins return for other invalid GraphQL payloads.
The same code path exists in both plugins:
- `apisix/plugins/graphql-limit-count.lua`, `check_graphql_request.POST`
- `apisix/plugins/graphql-proxy-cache.lua`, `check_graphql_request.POST`
Because the body comes straight from the client, any request that reaches a
route with either plugin enabled can trigger the error.
### Expected Behavior
A non-object JSON body should be rejected the same way as a body without a
`query` field: HTTP 400 with an `invalid graphql request, ...` message and no
Lua runtime error.
### Steps to Reproduce
1. Enable `graphql-limit-count` (or `graphql-proxy-cache`) on a route, for
example `POST /hello`.
2. Send a JSON scalar as the body:
```bash
curl -i -X POST http://127.0.0.1:9080/hello \
-H 'Content-Type: application/json' \
--data '123'
```
3. Observe HTTP 500 and the error log
`attempt to index local 'res' (a number value)`.
`true` and `"text"` behave the same way.
### Environment
- APISIX version: master, commit `c4f09e1f8297f5d825c26b9de310688b0fc127a8`
- Operating system: macOS (darwin) on the analysis machine
- OpenResty / Nginx version: not available locally, so the failure was
derived
from the code path; `cjson.decode` returns the scalar for `123`/`true` and
the next line indexes it
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
