Smalyshev added a comment. > Limit memory usage of queries
yes > Limit maximum duration of queries yes > Parsing the AST of the query to filter malicious queries No. We have a capability of doing AST filter (we actually have one already implementing label service) but we don't have any query filter. The main reason is we don't know which queries would be "malicious" - i.e. right now we don't have any data on what we need to filter out. In theory, we know some queries make no sense and would only cause load, but in practice, we don't have (yet) any real examples of queries that might do harm. If we identify such queries, we can probably add filtering for them. > It also seems useful to limit the number of parallel queries per IP. I think as it gets to the servers, we don't have much info on the originating IP, as we will be talking to Varnish frontends. So it may be needed to be implemented on Varnish side? Or Varnish passes us some info on that? > We can implement a number of countermeasures to contain an attacker > leveraging code injection inside BlazeGraph or through the JVM with the > privileges What kind of measures do you propose? TASK DETAIL https://phabricator.wikimedia.org/T90115 EMAIL PREFERENCES https://phabricator.wikimedia.org/settings/panel/emailpreferences/ To: csteipp, Smalyshev Cc: ksmith, JanZerebecki, Bene, MoritzMuehlenhoff, GWicke, Thompsonbry.systap, Smalyshev, Joe, Liuxinyu970226, csteipp, Beebs.systap, Haasepeter, Aklapper, Manybubbles, jkroll, Wikidata-bugs, Jdouglas, aude, Krenair, Malyacko, P.Copp _______________________________________________ Wikidata-bugs mailing list [email protected] https://lists.wikimedia.org/mailman/listinfo/wikidata-bugs
