Fix infinite recursion in type definition parser #642
Merged
Conversation
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Invizory
force-pushed
the
fix-infinite-recursion-in-parser
branch
from
6d83653 to
4188bd5
Compare
Invizory
changed the title
jamesdphillips
added a commit
to sensu/sensu-go
that referenced
this pull request
Aug 10, 2022
* Implements fix from: graphql-go/graphql#642 * I couldn't use the `replace` directive without a version tag so I've used my own fork. --- Signed-off-by: James Phillips <jamesdphillips@gmail.com>
jamesdphillips
added a commit
to sensu/sensu-go
that referenced
this pull request
Aug 11, 2022
* Implements fix from: graphql-go/graphql#642 * I couldn't use the `replace` directive without a version tag so I've used my own fork. --- Signed-off-by: James Phillips <jamesdphillips@gmail.com>
SpencerHedger
added a commit
to cantabular/graphql-go-graphql
that referenced
this pull request
Aug 23, 2022
|
What's blocking to merging this in and bumping the release? |
lgarrett-isp
approved these changes
Sep 8, 2022
stiggity
approved these changes
Sep 20, 2022
|
hey guys, this is blocking our deployments because it's getting caught from our code scanners, any ETA on when this can be merged and released? |
|
Hi guys, Can we merge this? This impacts our SCAs. |
snej
added a commit
to couchbase/sync_gateway
that referenced
this pull request
Mar 9, 2023
Our dependency graphql-go v0.8.0 has a bug in which a malformed schema string can cause a stack overflow in the parser, causing a Go panic. This is considered a DoS attack vector, assigned CVE-2022-37315. Seven months later, the fix for this bug has still not been merged, so we need to fork graphql-go and apply the fix ourselves. - Forked graphql-go repo to couchbasedeps/graphql-go. - In the forked repo, cherry-picked fix of CVE-2022-37315, from graphql-go/graphql#642 . Tagged this v0.8.1. - Updated SG's go.mod file to override original go-graphql with our fork. - Added a unit test in db/functions that tests the fix. I verified that, without the fix applied, this test panics; with it, it just returns an expected syntax error.
6 tasks
torcolvin
pushed a commit
to couchbase/sync_gateway
that referenced
this pull request
Mar 10, 2023
Our dependency graphql-go v0.8.0 has a bug in which a malformed schema string can cause a stack overflow in the parser, causing a Go panic. This is considered a DoS attack vector, assigned CVE-2022-37315. Seven months later, the fix for this bug has still not been merged, so we need to fork graphql-go and apply the fix ourselves. - Forked graphql-go repo to couchbasedeps/graphql-go. - In the forked repo, cherry-picked fix of CVE-2022-37315, from graphql-go/graphql#642 . Tagged this v0.8.1. - Updated SG's go.mod file to override original go-graphql with our fork. - Added a unit test in db/functions that tests the fix. I verified that, without the fix applied, this test panics; with it, it just returns an expected syntax error.
|
@chris-ramon @sogko I see you two are the owners of this org. Could you please merge this in to resolve the CVE? |
# for free
to join this conversation on GitHub.
Already have an account?
# to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Fixes #637.