hasura / hasura/graphql-engine

Update query with only pre-update checks enabled cause all row updates with empty where clause

Open
#9,552 1 comment 0 reactions 0 assignees View on GitHub
k/bug t/native-dbs
Dominant language
TypeScript
Stars
32.1k
Forks
3k
PR merge metrics
PR metrics pending

Description

### Version Information

Server Version: 2.16.0

### Environment

OSS

### What is the current behaviour?

Ref: https://hasura.io/docs/latest/api-reference/graphql-api/query/#trueexp
The documentation provided by Hasura regarding the GraphQL API query endpoint highlights that an empty object {} can be interpreted as a true expression. Consequently, when using the where argument with an empty object as the value for the id field, it can be considered as equivalent to where: {id: {}}, which translates to WHERE TRUE in SQL. This condition would result in updating the entire database, as all rows would match.

However, it is important to note that the documentation also specifies that this condition is checked during a pre-update check to determine which rows are eligible for updating. Thus, the query would only update the rows that satisfy the pre-update check, as well as any post-update checks that are specified.

Therefore, it is crucial to properly define the pre-update and post-update checks when using the where argument with an empty object as the value for the id field, to ensure that only the intended rows are updated, and to prevent any unintended updates to the entire database.

### What is the expected behaviour?

When using a mutation to update rows in a table with an empty where clause, having only pre-update checks in place should ensure that the operation remains restricted to the eligible rows as determined by the pre-update checks. Therefore, it should not affect all rows in the table.

### How to reproduce the issue?

1. Track table in Hasura
2. Update permissions for the role to have pre-update checks.
3. Execute mutation to update table rows with empty where clause.
4. It will update all the rows rather than restricting to the rows according the attributes constraints mentioned in the pre-update checks.

### Any possible solutions/workarounds you're aware of?

To ensure that the update operation is restricted to the intended rows even when using an empty where clause, it is necessary to define both pre-update checks and post-update checks. By doing so, the entire database will not be updated, and only the rows that satisfy the pre-update & post-update checks will be affected.

### Keywords

pre-update checks, post-update checks, database

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.