hasura / hasura/graphql-engine
Error when inserting jsonb field with ${ character sequence
Nobody has claimed this yet.
- Dominant language
- TypeScript
- Stars
- 32.1k
- Forks
- 3k
- PR merge metrics
- PR metrics pending
Description
### Version Information
Server Version: v2.2.2-cloud.1
### Environment
Cloud
### What is the expected behaviour?
Inserting json string values should work regardless of their contents.
### Keywords
jsonb,escape character
### What is the current behaviour?
When inserting a row with a jsonb field, the character combination `${`, in a value of the json object being inserted, can cause the request to fail with a 403 forbidden code. Specifically `${` must occur in the value without a closing bracket. Initially, I thought that inserting `${` alone would fail but that does not seem to be the case. It looks like there must be some other characters around the sequence to cause the error.
### How to reproduce the issue?
1. Create a tracked table with a jsonb column
2. Attempt to insert a new object for that table with a value for the jsonb field that contains the problematic sequence (i.e. `{ metadata: { blurhash: "U3L1wD${jbM$N19Jt5-,4sV{R+SfkR_IV[Dm" }}`)
3. Play around with altering the string value to see what will and what won't break the request.
### Screenshots or Screencast
https://user-images.githubusercontent.com/1716299/159100522-b0086d21-6139-4edf-901f-391149a1e367.mov
### Please provide any traces or logs that could help here.
```
{
"message": "Failed to fetch",
"stack": "TypeError: Failed to fetch\n at https://graphql-engine-cdn.hasura.io/cloud-console/assets/channel/versioned/v2.2.2-cloud.1/vendor.js.gz:1:160051\n at new Promise ()\n at https://graphql-engine-cdn.hasura.io/cloud-console/assets/channel/versioned/v2.2.2-cloud.1/vendor.js.gz:1:159972\n at https://graphql-engine-cdn.hasura.io/cloud-console/assets/channel/versioned/v2.2.2-cloud.1/vendor.js.gz:1:5798313\n at e (https://graphql-engine-cdn.hasura.io/cloud-console/assets/channel/versioned/v2.2.2-cloud.1/vendor.js.gz:1:394025)\n at e (https://graphql-engine-cdn.hasura.io/cloud-console/assets/channel/versioned/v2.2.2-cloud.1/vendor.js.gz:1:983682)\n at z._fetchQuery (https://graphql-engine-cdn.hasura.io/cloud-console/assets/channel/versioned/v2.2.2-cloud.1/vendor.js.gz:1:10326013)\n at Object.handleRunQuery [as onRun] (https://graphql-engine-cdn.hasura.io/cloud-console/assets/channel/versioned/v2.2.2-cloud.1/vendor.js.gz:1:10312287)\n at _onClick (https://graphql-engine-cdn.hasura.io/cloud-console/assets/channel/versioned/v2.2.2-cloud.1/vendor.js.gz:1:10330035)\n at Object.l (https://graphql-engine-cdn.hasura.io/cloud-console/assets/channel/versioned/v2.2.2-cloud.1/vendor.js.gz:1:12222866)"
}
```
### Can you identify the location in the source code where the problem exists?
No
### If the bug is confirmed, would you be willing to submit a PR?
No, I wouldn't know the codebase well enough to fix the issue.
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
No source file or test is identified. Start by reproducing the JSONB insert through the Cloud console using the `${` value from the issue, then trace the failed request and its 403 response through the GraphQL API path. Done means valid JSONB values containing the sequence insert successfully without a forbidden response, with regression coverage added where the failure is isolated.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- postgresql, typescript
- Domain
- api, databases
- Issue type
- Bug
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Stale
- Clarity
- Needs clarification
- Newbie friendliness
- 30/100