hasura / hasura/graphql-engine

Error when inserting jsonb field with ${ character sequence

Open
#8,344 3 comments 0 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

k/bug support/needs-more-info
Dominant language
TypeScript
Stars
32.1k
Forks
3k
PR merge metrics
PR metrics pending

Description

### Version Information

Server Version: v2.2.2-cloud.1

### Environment

Cloud

### What is the expected behaviour?

Inserting json string values should work regardless of their contents.

### Keywords

jsonb,escape character

### What is the current behaviour?

When inserting a row with a jsonb field, the character combination `${`, in a value of the json object being inserted, can cause the request to fail with a 403 forbidden code. Specifically `${` must occur in the value without a closing bracket. Initially, I thought that inserting `${` alone would fail but that does not seem to be the case. It looks like there must be some other characters around the sequence to cause the error.

### How to reproduce the issue?

1. Create a tracked table with a jsonb column
2. Attempt to insert a new object for that table with a value for the jsonb field that contains the problematic sequence (i.e. `{ metadata: { blurhash: "U3L1wD${jbM$N19Jt5-,4sV{R+SfkR_IV[Dm" }}`)
3. Play around with altering the string value to see what will and what won't break the request.

### Screenshots or Screencast

https://user-images.githubusercontent.com/1716299/159100522-b0086d21-6139-4edf-901f-391149a1e367.mov

### Please provide any traces or logs that could help here.

```
{
"message": "Failed to fetch",
"stack": "TypeError: Failed to fetch\n at https://graphql-engine-cdn.hasura.io/cloud-console/assets/channel/versioned/v2.2.2-cloud.1/vendor.js.gz:1:160051\n at new Promise ()\n at https://graphql-engine-cdn.hasura.io/cloud-console/assets/channel/versioned/v2.2.2-cloud.1/vendor.js.gz:1:159972\n at https://graphql-engine-cdn.hasura.io/cloud-console/assets/channel/versioned/v2.2.2-cloud.1/vendor.js.gz:1:5798313\n at e (https://graphql-engine-cdn.hasura.io/cloud-console/assets/channel/versioned/v2.2.2-cloud.1/vendor.js.gz:1:394025)\n at e (https://graphql-engine-cdn.hasura.io/cloud-console/assets/channel/versioned/v2.2.2-cloud.1/vendor.js.gz:1:983682)\n at z._fetchQuery (https://graphql-engine-cdn.hasura.io/cloud-console/assets/channel/versioned/v2.2.2-cloud.1/vendor.js.gz:1:10326013)\n at Object.handleRunQuery [as onRun] (https://graphql-engine-cdn.hasura.io/cloud-console/assets/channel/versioned/v2.2.2-cloud.1/vendor.js.gz:1:10312287)\n at _onClick (https://graphql-engine-cdn.hasura.io/cloud-console/assets/channel/versioned/v2.2.2-cloud.1/vendor.js.gz:1:10330035)\n at Object.l (https://graphql-engine-cdn.hasura.io/cloud-console/assets/channel/versioned/v2.2.2-cloud.1/vendor.js.gz:1:12222866)"
}
```

### Can you identify the location in the source code where the problem exists?

No

### If the bug is confirmed, would you be willing to submit a PR?

No, I wouldn't know the codebase well enough to fix the issue.

Contributor guide

Open the contributing guide

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Research direction

No source file or test is identified. Start by reproducing the JSONB insert through the Cloud console using the `${` value from the issue, then trace the failed request and its 403 response through the GraphQL API path. Done means valid JSONB values containing the sequence insert successfully without a forbidden response, with regression coverage added where the failure is isolated.

Written by the indexing model from the issue text.

Assessment

Tech stack
postgresql, typescript
Domain
api, databases
Issue type
Bug
Difficulty
4/5
Estimated time
3-5 days
Activity status
Stale
Clarity
Needs clarification
Newbie friendliness
30/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.