GraphQL API を悪意あるクエリから守る手法

Slide 1

Slide 1 text

ϖύϘɾ͸ͯͳٕज़େձ ZJHBSBTIJ (SBQI2-"1*Λ ѱҙ͋ΔΫΤϦ͔ΒकΔख๏

Slide 2

Slide 2 text

(SBQI2-

Slide 3

Slide 3 text

ಋೖ(SBQI2- "1*ͷͨΊͷΫΤϦݴޠͱΫΤϦʹԠͨ͡σʔλΛฦ͢ϥϯλΠϜ

Slide 4

Slide 4 text

ಋೖ(SBQI2- "1*ͷͨΊͷΫΤϦݴޠͱΫΤϦʹԠͨ͡σʔλΛฦ͢ϥϯλΠϜ ΫϥΠΞϯτ αʔόʔ ʢϥϯλΠϜʣ

Slide 5

Slide 5 text

ಋೖ(SBQI2- "1*ͷͨΊͷΫΤϦݴޠͱΫΤϦʹԠͨ͡σʔλΛฦ͢ϥϯλΠϜ ΫϥΠΞϯτ αʔόʔ ʢϥϯλΠϜʣ { me { name interests } } ΫΤϦ

Slide 6

Slide 6 text

ಋೖ(SBQI2- "1*ͷͨΊͷΫΤϦݴޠͱΫΤϦʹԠͨ͡σʔλΛฦ͢ϥϯλΠϜ ΫϥΠΞϯτ αʔόʔ ʢϥϯλΠϜʣ { me { name interests } } ΫΤϦ { "me": { "name": "yigarashi", "interests": [ "ϓϩδΣΫτϚωδϝϯτ", "GraphQL", "ϓϩάϥϛϯάݴޠཧ࿦", ] } } ฦΓ஋ʢ+40/ʣ

Slide 7

Slide 7 text

Slide 8

Slide 8 text

ಋೖ(SBQI2- ΋͏গ͠ෳࡶͳྫ ΫϥΠΞϯτ αʔόʔ ʢϥϯλΠϜʣ

Slide 9

Slide 9 text

ಋೖ(SBQI2- ΋͏গ͠ෳࡶͳྫ ΫϥΠΞϯτ αʔόʔ ʢϥϯλΠϜʣ { countries(first: 1) { name cities(first: 2) { name } } } ΫΤϦ

Slide 10

Slide 10 text

ಋೖ(SBQI2- ΋͏গ͠ෳࡶͳྫ ΫϥΠΞϯτ αʔόʔ ʢϥϯλΠϜʣ { countries(first: 1) { name cities(first: 2) { name } } } ΫΤϦ Ҿ਺Λड͚औΔ͜ͱ͕Ͱ͖Δɻ pSTU͸42-Ͱݴ͏MJNJU

Slide 11

Slide 11 text

ಋೖ(SBQI2- ΋͏গ͠ෳࡶͳྫ ΫϥΠΞϯτ αʔόʔ ʢϥϯλΠϜʣ { countries(first: 1) { name cities(first: 2) { name } } } ΫΤϦ { "countries": [ { "name": "೔ຊ", "cities": [ { "name": "ژ౎ࢢ" }, { "name": "৽॓۠" }, ] }, ] } ฦΓ஋ʢ+40/ʣ Ҿ਺Λड͚औΔ͜ͱ͕Ͱ͖Δɻ pSTU͸42-Ͱݴ͏MJNJU

Slide 12

Slide 12 text

ύϫϑϧ

Slide 13

Slide 13 text

ѱҙ͋Δਓ͕ ࢖͏ͱʜʜ

Slide 14

Slide 14 text

ѱҙ͋ΔΫΤϦ ΫϥΠΞϯτ αʔόʔ ʢϥϯλΠϜʣ

Slide 15

Slide 15 text

ѱҙ͋ΔΫΤϦ ΫϥΠΞϯτ αʔόʔ ʢϥϯλΠϜʣ { countries(first: 100) { name cities(first: 100) { name streets(first: 1000) { name } } } } ΫΤϦ

Slide 16

Slide 16 text

ѱҙ͋ΔΫΤϦ ΫϥΠΞϯτ αʔόʔ ʢϥϯλΠϜʣ { countries(first: 100) { name cities(first: 100) { name streets(first: 1000) { name } } } } ΫΤϦ

Slide 17

Slide 17 text

ѱҙ͋ΔΫΤϦ ΫϥΠΞϯτ αʔόʔ ʢϥϯλΠϜʣ { countries(first: 100) { name cities(first: 100) { name streets(first: 1000) { name } } } } ΫΤϦ ºº ສϊʔυ

Slide 18

Slide 18 text

ѱҙ͋ΔΫΤϦ ΫϥΠΞϯτ αʔόʔ ʢϥϯλΠϜʣ { countries(first: 100) { name cities(first: 100) { name streets(first: 1000) { name } } } } ΫΤϦ ºº ສϊʔυ

Slide 19

Slide 19 text

ѱҙ͋ΔΫΤϦ ΫϥΠΞϯτ αʔόʔ ʢϥϯλΠϜʣ

Slide 20

Slide 20 text

ѱҙ͋ΔΫΤϦ ΫϥΠΞϯτ αʔόʔ ʢϥϯλΠϜʣ { countries(first: 100) { cities(first: 100) { superComplexStatistics } } } ΫΤϦ

Slide 21

Slide 21 text

ѱҙ͋ΔΫΤϦ ΫϥΠΞϯτ αʔόʔ ʢϥϯλΠϜʣ { countries(first: 100) { cities(first: 100) { superComplexStatistics } } } ΫΤϦ

Slide 22

Slide 22 text

ѱҙ͋ΔΫΤϦ ΫϥΠΞϯτ αʔόʔ ʢϥϯλΠϜʣ { countries(first: 100) { cities(first: 100) { superComplexStatistics } } } ΫΤϦ ඇৗʹॏ͍ܭࢉΛ ճ

Slide 23

Slide 23 text

ѱҙ͋ΔΫΤϦ ΫϥΠΞϯτ αʔόʔ ʢϥϯλΠϜʣ { countries(first: 100) { cities(first: 100) { superComplexStatistics } } } ΫΤϦ ඇৗʹॏ͍ܭࢉΛ ճ

Slide 24

Slide 24 text

ࠓ೔ͷςʔϚ (SBQI2-"1*Λѱҙ͋ΔΫΤϦʢʹҙਤతʹෛՙΛ͔͚ΔΫΤϦʣ͔ΒकΔ

Slide 25

Slide 25 text

ࠓ೔ͷςʔϚ (SBQI2-"1*Λѱҙ͋ΔΫΤϦʢʹҙਤతʹෛՙΛ͔͚ΔΫΤϦʣ͔ΒकΔ యܕతͳෛՙʢσʔλͷऔಘݩ͸3%#ͱԾఆ͢Δʣ σʔλྔ ܭࢉྔ جຊతͳΞΠσΟΞ ʮΫΤϦΛ੩తղੳͯ͠ෛՙͷ໰୊͕ͳ͍͜ͱΛ֬ೝ࣮ͯ͠ߦ͢Δʯ

Slide 26

Slide 26 text

۩ମతͳख๏ ϗϫΠτϦετʹΑΔ੍ݶ DPNQMFYJUZʹΑΔ੍ݶ

Slide 27

Slide 27 text

۩ମతͳख๏ ϗϫΠτϦετʹΑΔ੍ݶ DPNQMFYJUZʹΑΔ੍ݶ

Slide 28

Slide 28 text

ϗϫΠτϦετʹΑΔ੍ݶ αʔόʔ͕ड͚෇͚ΔΫΤϦΛϗϫΠτϦετͱ͓ͯ࣋ͬͯ͘͠ɻϦΫΤετ͞ ΕͨΫΤϦ͕ϗϫΠτϦετʹҰக͢Δ৔߹͚࣮ͩߦ͢Δ αʔόʔ ʢϥϯλΠϜʣ ΫϥΠΞϯτ

Slide 29

Slide 29 text

ϗϫΠτϦετʹΑΔ੍ݶ αʔόʔ͕ड͚෇͚ΔΫΤϦΛϗϫΠτϦετͱ͓ͯ࣋ͬͯ͘͠ɻϦΫΤετ͞ ΕͨΫΤϦ͕ϗϫΠτϦετʹҰக͢Δ৔߹͚࣮ͩߦ͢Δ αʔόʔ ʢϥϯλΠϜʣ { countries(first: 10) { name } } ϗϫΠτϦετ ʜ ʜ ΫϥΠΞϯτ

Slide 30

Slide 30 text

ϗϫΠτϦετʹΑΔ੍ݶ αʔόʔ͕ड͚෇͚ΔΫΤϦΛϗϫΠτϦετͱ͓ͯ࣋ͬͯ͘͠ɻϦΫΤετ͞ ΕͨΫΤϦ͕ϗϫΠτϦετʹҰக͢Δ৔߹͚࣮ͩߦ͢Δ αʔόʔ ʢϥϯλΠϜʣ { countries(first: 10) { name } } ϗϫΠτϦετ ʜ ʜ ΫϥΠΞϯτ { countries(first: 10) { name } }

Slide 31

Slide 31 text

Slide 32

Slide 32 text

Slide 33

Slide 33 text

Slide 34

Slide 34 text

Slide 35

Slide 35 text

ϗϫΠτϦετʹΑΔ੍ݶ ϝϦοτ ಋೖ͕༰қʢΫΤϦ͕จࣈྻͱͯ͠Ұக͢Δ͔֬ೝ͢Δ͚ͩͰྑ͍ʣ ޮՌ͕ߴ͍ʢຊ౰ʹ࢖͏ΫΤϦͷΈϗϫΠτϦετͱͯ͠ڐՄ͢ΔͨΊʣ σϝϦοτ ϗϫΠτϦετͷϝϯςφϯείετ ެ։"1*΍εςʔΫϗϧμʔͷҧ͏ΫϥΠΞϯτͰ͸࢖͍ͮΒ͍ ૯ධ ؔ܎͢Δ։ൃऀɾΫϥΠΞϯτ͕গͳ͍৔߹ʹ͔ͳΓ༗ޮ

Slide 36

Slide 36 text

۩ମతͳख๏ ϗϫΠτϦετʹΑΔ੍ݶ DPNQMFYJUZʹΑΔ੍ݶ

Slide 37

Slide 37 text

۩ମతͳख๏ ϗϫΠτϦετʹΑΔ੍ݶ DPNQMFYJUZʹΑΔ੍ݶ

Slide 38

Slide 38 text

DPNQMFYJUZʹΑΔ੍ݶ ΫΤϦͷෛՙʹൺྫͯ͠େ͖͘ͳΔ਺஋ʢDPNQMFYJUZʣΛܭࢉ͢Δɻͦͷ਺ ஋͕ᮢ஋Λ௒͑ͨ৔߹͸࣮ߦ͠ͳ͍

Slide 39

Slide 39 text

DPNQMFYJUZʹΑΔ੍ݶ ΫΤϦͷෛՙʹൺྫͯ͠େ͖͘ͳΔ਺஋ʢDPNQMFYJUZʣΛܭࢉ͢Δɻͦͷ਺ ஋͕ᮢ஋Λ௒͑ͨ৔߹͸࣮ߦ͠ͳ͍ యܕతͳෛՙʹ͍ͭͯDPNQMFYJUZͷྫΛݟ͍ͯ͘ σʔλྔ ܭࢉྔ %#ΞΫηεճ਺ ʢ஫ҙʣDPNQMFYJUZͷܭࢉํ๏͸ແ਺ʹߟ͑ΒΕΔɻࠓ೔ࣔ͢ͷ͸Ұྫ

Slide 40

Slide 40 text

ྫϊʔυ਺ʹൺྫ͢ΔDPNQMFYJUZ

Slide 41

Slide 41 text

ྫϊʔυ਺ʹൺྫ͢ΔDPNQMFYJUZ { countries(first: 50) { name cities(first: 100) { name } } }

Slide 42

Slide 42 text

ྫϊʔυ਺ʹൺྫ͢ΔDPNQMFYJUZ ϊʔυ਺DPVOUSJFTºDJUJFT OPEFT { countries(first: 50) { name cities(first: 100) { name } } }

Slide 43

Slide 43 text

ྫϊʔυ਺ʹൺྫ͢ΔDPNQMFYJUZ ϊʔυ਺DPVOUSJFTºDJUJFT OPEFT ͜Ε͕ᮢ஋ҎԼͳΒ࣮ߦ͢Δ { countries(first: 50) { name cities(first: 100) { name } } }

Slide 44

Slide 44 text

ྫϊʔυ਺ʹൺྫ͢ΔDPNQMFYJUZ ϊʔυ਺DPVOUSJFTºDJUJFT OPEFT ͜Ε͕ᮢ஋ҎԼͳΒ࣮ߦ͢Δ { countries(first: 50) { name cities(first: 100) { name } } } ࢀߟ(JU)VC(SBQI2-"1*Wͷ/PEFMJNJU ϊʔυ਺͸ ·Ͱ ϦετͷऔಘͰ͸Ҿ਺ʹpSTU͔MBTU͕ඞਢͰҎ಺

Slide 45

Slide 45 text

ྫܭࢉίετʹൺྫ͢ΔDPNQMFYJUZ

Slide 46

Slide 46 text

ྫܭࢉίετʹൺྫ͢ΔDPNQMFYJUZ type City { name superComplexStatistics @cost(n: 10) }

Slide 47

Slide 47 text

ྫܭࢉίετʹൺྫ͢ΔDPNQMFYJUZ type City { name superComplexStatistics @cost(n: 10) } (SBQI2-ͷEJSFDUJWFΛར༻ͯ͠ɺ ܕఆٛʢεΩʔϚʣͷଆͰॏ͍ܭࢉʹίετΛ͚ͭΔɻ αʔόʔ͸͜ͷ৘ใΛࢀরͯ͠DPNQMFYJUZΛܭࢉ͢Δ

Slide 48

Slide 48 text

Slide 49

Slide 49 text

Slide 50

Slide 50 text

ྫܭࢉίετʹൺྫ͢ΔDPNQMFYJUZ type City { name superComplexStatistics @cost(n: 10) } (SBQI2-ͷEJSFDUJWFΛར༻ͯ͠ɺ ܕఆٛʢεΩʔϚʣͷଆͰॏ͍ܭࢉʹίετΛ͚ͭΔɻ αʔόʔ͸͜ͷ৘ใΛࢀরͯ͠DPNQMFYJUZΛܭࢉ͢Δ { countries(first: 100) { cities(first: 100) { superComplexStatistics } } } ܭࢉίετ ºDJUJFT ºDPTU ΫΤϦ %#ΞΫηεճ਺΋શ͘ಉ͡ΞΠσΟΞͰDPNQMFYJUZΛઃܭͰ͖Δɻ%#ΞΫ ηε͕ൃੜ͢ΔϑΟʔϧυʹDPTUΛ͚ͭΕ͹ɺ%#ΞΫηεճ਺ʹൺྫͯ͠ DPNQMFYJUZ͕૿Ճ͢ΔΑ͏ʹͰ͖Δɻ

Slide 51

Slide 51 text

࣮૷ (SBQI2-Ͱྑ͘࢖ΘΕΔݴޠͰ͸ϥΠϒϥϦ౳ͷαϙʔτ͕͋Δ +BWB4DSJQUHSBQIRMDPTUBOBMZTJTͳͲ (PHRMHFO͕αϙʔτ͍ͯ͠Δ αϙʔτͷͳ͍ݴޠͰͲ͏͢Δ͔ ΫΤϦղੳ͚ͩϚΠΫϩαʔϏεͱͯ͠੾Γग़ͯ͠ผݴޠΛ࢖͏ ࣗલͰ࣮૷͢Δ

Slide 52

Slide 52 text

ମݧஊ ͱ͋ΔαʔϏεͰϑϧεΫϥονͰΫΤϦղੳΛ࣮૷ʢ1FSMͩͬͨͷͰʜʣ εςʔΫϗϧμʔͷҧ͏ΫϥΠΞϯτ͕༧૝͞ΕͨͷͰϗϫΠτϦετʹΑΔ ੍ݶ͸ݟૹͬͨ QBSTFͱFYFDVUFͷؒʹDPNQMFYJUZʹΑΔ੍ݶΛ࢓ࠐΜͩ ϕʔε͸ϊʔυ਺ʹΑΔ੍ݶ શ݅औಘ͢ΔϑΟʔϧυ΍%#ΞΫηε͕ൃੜ͢ΔϑΟʔϧυʹߴΊͷίε τΛ͚ͭΔ ᮢ஋͸௨ৗར༻Λ્֐͠ͳ͍େ͖Ίͷ஋ʹઃఆ ؀ڥม਺Ͱᮢ஋ΛઃఆͰ͖ΔΑ͏ʹͯ͠ૉૣ͘ରॲՄೳʹ

Slide 53

Slide 53 text

ݱঢ়ͷ՝୊ DPNQMFYJUZͷϕετϓϥΫςΟεཱ͕֬͞Ε͍ͯͳ͍ ࠓճ͸ϊʔυ਺ɾܭࢉίετɾ%#ΞΫηεʹண໨ͯٞ͠࿦Λ͕ͨ͠ɺͦ΋ ͦ΋͜͜·Ͱ౿ΈࠐΜͰٞ࿦͍ͯ͠Δࢿྉ͕গͳ͍ ޙΖʹ%#Ҏ֎͕͍ΔέʔεͳͲଞʹ΋࿦఺͸͋Γͦ͏ ੈͷதͷϥΠϒϥϦ͸DPNQMFYJUZ͕ͻͱͭͷέʔεΛް͘αϙʔτ͍ͯ͠Δ ϊʔυ਺ɾܭࢉίετͱ͍ͬͨෳ਺ͷई౓Λѻ͍ͮΒ͍ ࢓ํͳ͘ͻͱͭͷDPNQMFYJUZʹෳ਺ͷई౓Λԡ͠ࠐΉ͜ͱ΋ +BWB4DSJQUͷHSBQIRMDPTUBOBMZTJTͰ͸࣮ݱՄೳͳ͜ͱΛ֬ೝ

Slide 54

Slide 54 text

·ͱΊ (SBQI2-Ͱ͸ҙਤతʹෛՙΛ͔͚ΔΫΤϦΛ༰қʹهड़Ͱ͖Δ ͭͷ๷ӴखஈΛ঺հͨ͠ ϗϫΠτϦετʹΑΔ੍ݶ DPNQMFYJUZʹΑΔ੍ݶ ׬ᘳͳ๷Ӵ͸ඞͣ͠΋ඞཁͳ͍ ϦεΫͱରࡦͷશମ૾Λݟ౉͠ཁ݅ʹ͋ͬͨίεύͷྑ͍ํ਑ΛऔΔ ϒϩάهࣄ൛ʮ(SBQI2-"1*Λѱҙ͋ΔΫΤϦ͔ΒकΔख๏ʯ IUUQTZJHBSBTIJIBUFOBCMPHDPNFOUSZHSBQIRMRVFSZBOBMZTJT