Skip to content

NEBULA-4397: Issue with enforcing SafeListing for both internal and external clients #7509

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
SimonSapin merged 3 commits into from
May 19, 2025
Merged

NEBULA-4397: Issue with enforcing SafeListing for both internal and external clients #7509

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
3 commits
Select commit Hold shift + click to select a range
28a5340
feat: enhance logging for unknown operations
DaleSeo May 16, 2025
f50db3a
test: update snapshots
DaleSeo May 16, 2025
8339c43
chore: fix a typo in the comment
DaleSeo May 16, 2025
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
18 changes: 14 additions & 4 deletions apollo-router/src/services/layers/persisted_queries/mod.rs
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -111,7 +111,13 @@ impl PersistedQueryLayer {
// If we don't have an ID and we require an ID, return an error immediately,
if log_unknown {
if let Some(operation_body) = request.supergraph_request.body().query.as_ref() {
log_unknown_operation(operation_body);
// Note: it's kind of inconsistent that if we require
// IDs and skip_enforcement is set, we don't call
// log_unknown_operation on freeform GraphQL, but if we
// *don't* require IDs and skip_enforcement is set, we
// *do* call log_unknown_operation on unknown
// operations.
log_unknown_operation(operation_body, false);
}
}
Err(supergraph_err_pq_id_required(request))
Expand Down Expand Up @@ -295,7 +301,7 @@ impl PersistedQueryLayer {
));
}
if freeform_graphql_action.should_log {
log_unknown_operation(operation_body);
log_unknown_operation(operation_body, skip_enforcement);
metric_attributes.push(opentelemetry::KeyValue::new(
"persisted_queries.logged".to_string(),
true,
Expand All @@ -322,8 +328,12 @@ impl PersistedQueryLayer {
}
}

fn log_unknown_operation(operation_body: &str) {
tracing::warn!(message = "unknown operation", operation_body);
fn log_unknown_operation(operation_body: &str, enforcement_skipped: bool) {
tracing::warn!(
message = "unknown operation",
operation_body,
enforcement_skipped
);
}

#[derive(Debug, Clone, Eq, PartialEq)]
Expand Down
4 changes: 4 additions & 0 deletions ...sisted_queries__tests__pq_layer_freeform_graphql_with_safelist_log_unknown_true@logs.snap
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -6,18 +6,22 @@ expression: yaml
level: INFO
message: Loaded 2 persisted queries.
- fields:
enforcement_skipped: false
Copy link

@pubmodmatt pubmodmatt May 16, 2025

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

It's a problem that this test passes when the snapshot doesn't match. This indicates something is wrong with the assert_snapshot_subscriber implementation. This needs to be fixed - if it isn't done as part of this PR, then the router team should investigate separately.

Copy link
Member Author

@DaleSeo DaleSeo May 16, 2025

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

@pubmodmatt Good callout! I’ve submitted a ticket with the router team to investigate it separately.

operation_body: "query SomeQuery { me { id } }"
level: WARN
message: unknown operation
- fields:
enforcement_skipped: true
operation_body: "query SomeQuery { me { id } }"
level: WARN
message: unknown operation
- fields:
enforcement_skipped: false
operation_body: "fragment A on Query { me { id } } query SomeOp { ...A ...B } fragment,,, B on Query{me{username,name} } # yeah"
level: WARN
message: unknown operation
- fields:
enforcement_skipped: false
operation_body: "fragment F on Query { __typename foo: __schema { __typename } me { id } } query Q { __type(name: \"foo\") { name } ...F }"
level: WARN
message: unknown operation