GraphQL API を悪意あるクエリから守る手法

ϖύϘɾ͸ͯͳٕज़େձ ZJHBSBTIJ (SBQI2-"1*Λ ѱҙ͋ΔΫΤϦ͔ΒकΔख๏

(SBQI2-

ಋೖ(SBQI2- "1*ͷͨΊͷΫΤϦݴޠͱΫΤϦʹԠͨ͡σʔλΛฦ͢ϥϯλΠϜ

ಋೖ(SBQI2- "1*ͷͨΊͷΫΤϦݴޠͱΫΤϦʹԠͨ͡σʔλΛฦ͢ϥϯλΠϜ ΫϥΠΞϯτ αʔόʔ ʢϥϯλΠϜʣ

ಋೖ(SBQI2- "1*ͷͨΊͷΫΤϦݴޠͱΫΤϦʹԠͨ͡σʔλΛฦ͢ϥϯλΠϜ ΫϥΠΞϯτ αʔόʔ ʢϥϯλΠϜʣ { me { name interests
} } ΫΤϦ

} } ΫΤϦ { "me": { "name": "yigarashi", "interests": [ "ϓϩδΣΫτϚωδϝϯτ", "GraphQL", "ϓϩάϥϛϯάݴޠཧ࿦", ] } } ฦΓ஋ʢ+40/ʣ

} } ΫΤϦ { "me": { "name": "yigarashi", "interests": [ "ϓϩδΣΫτϚωδϝϯτ", "GraphQL", "ϓϩάϥϛϯάݴޠཧ࿦", ] } } ฦΓ஋ʢ+40/ʣ ΫΤϦͱಉ͡ܗͷ +40/͕ฦ͞ΕΔ

ಋೖ(SBQI2- ΋͏গ͠ෳࡶͳྫ ΫϥΠΞϯτ αʔόʔ ʢϥϯλΠϜʣ

ಋೖ(SBQI2- ΋͏গ͠ෳࡶͳྫ ΫϥΠΞϯτ αʔόʔ ʢϥϯλΠϜʣ { countries(first: 1) { name
cities(first: 2) { name } } } ΫΤϦ

cities(first: 2) { name } } } ΫΤϦ Ҿ਺Λड͚औΔ͜ͱ͕Ͱ͖Δɻ pSTU͸42-Ͱݴ͏MJNJU

cities(first: 2) { name } } } ΫΤϦ { "countries": [ { "name": "೔ຊ", "cities": [ { "name": "ژ౎ࢢ" }, { "name": "৽॓۠" }, ] }, ] } ฦΓ஋ʢ+40/ʣ Ҿ਺Λड͚औΔ͜ͱ͕Ͱ͖Δɻ pSTU͸42-Ͱݴ͏MJNJU

ύϫϑϧ

ѱҙ͋Δਓ͕ ࢖͏ͱʜʜ

ѱҙ͋ΔΫΤϦ ΫϥΠΞϯτ αʔόʔ ʢϥϯλΠϜʣ

ѱҙ͋ΔΫΤϦ ΫϥΠΞϯτ αʔόʔ ʢϥϯλΠϜʣ { countries(first: 100) { name
cities(first: 100) { name streets(first: 1000) { name } } } } ΫΤϦ

ѱҙ͋ΔΫΤϦ ΫϥΠΞϯτ αʔόʔ ʢϥϯλΠϜʣ { countries(first: 100) { name
cities(first: 100) { name streets(first: 1000) { name } } } } ΫΤϦ ºº ສϊʔυ

ѱҙ͋ΔΫΤϦ ΫϥΠΞϯτ αʔόʔ ʢϥϯλΠϜʣ

ѱҙ͋ΔΫΤϦ ΫϥΠΞϯτ αʔόʔ ʢϥϯλΠϜʣ { countries(first: 100) { cities(first:
100) { superComplexStatistics } } } ΫΤϦ

ѱҙ͋ΔΫΤϦ ΫϥΠΞϯτ αʔόʔ ʢϥϯλΠϜʣ { countries(first: 100) { cities(first:
100) { superComplexStatistics } } } ΫΤϦ ඇৗʹॏ͍ܭࢉΛ ճ

ࠓ೔ͷςʔϚ (SBQI2-"1*Λѱҙ͋ΔΫΤϦʢʹҙਤతʹෛՙΛ͔͚ΔΫΤϦʣ͔ΒकΔ

ࠓ೔ͷςʔϚ (SBQI2-"1*Λѱҙ͋ΔΫΤϦʢʹҙਤతʹෛՙΛ͔͚ΔΫΤϦʣ͔ΒकΔ యܕతͳෛՙʢσʔλͷऔಘݩ͸3%#ͱԾఆ͢Δʣ σʔλྔ ܭࢉྔ جຊతͳΞΠσΟΞ ʮΫΤϦΛ੩తղੳͯ͠ෛՙͷ໰୊͕ͳ͍͜ͱΛ֬ೝ࣮ͯ͠ߦ͢Δʯ

۩ମతͳख๏ ϗϫΠτϦετʹΑΔ੍ݶ DPNQMFYJUZʹΑΔ੍ݶ

ϗϫΠτϦετʹΑΔ੍ݶ αʔόʔ͕ड͚෇͚ΔΫΤϦΛϗϫΠτϦετͱ͓ͯ࣋ͬͯ͘͠ɻϦΫΤετ͞ ΕͨΫΤϦ͕ϗϫΠτϦετʹҰக͢Δ৔߹͚࣮ͩߦ͢Δ αʔόʔ ʢϥϯλΠϜʣ ΫϥΠΞϯτ

ϗϫΠτϦετʹΑΔ੍ݶ αʔόʔ͕ड͚෇͚ΔΫΤϦΛϗϫΠτϦετͱ͓ͯ࣋ͬͯ͘͠ɻϦΫΤετ͞ ΕͨΫΤϦ͕ϗϫΠτϦετʹҰக͢Δ৔߹͚࣮ͩߦ͢Δ αʔόʔ ʢϥϯλΠϜʣ { countries(first: 10) { name
} } ϗϫΠτϦετ ʜ ʜ ΫϥΠΞϯτ

} } ϗϫΠτϦετ ʜ ʜ ΫϥΠΞϯτ { countries(first: 10) { name } }

} } ϗϫΠτϦετ ʜ ʜ ΫϥΠΞϯτ

} } ϗϫΠτϦετ ʜ ʜ ΫϥΠΞϯτ { countries(first: 10) { name population } }

ϗϫΠτϦετʹΑΔ੍ݶ ϝϦοτ ಋೖ͕༰қʢΫΤϦ͕จࣈྻͱͯ͠Ұக͢Δ͔֬ೝ͢Δ͚ͩͰྑ͍ʣ ޮՌ͕ߴ͍ʢຊ౰ʹ࢖͏ΫΤϦͷΈϗϫΠτϦετͱͯ͠ڐՄ͢ΔͨΊʣ σϝϦοτ ϗϫΠτϦετͷϝϯςφϯείετ ެ։"1*΍εςʔΫϗϧμʔͷҧ͏ΫϥΠΞϯτͰ͸࢖͍ͮΒ͍ ૯ධ ؔ܎͢Δ։ൃऀɾΫϥΠΞϯτ͕গͳ͍৔߹ʹ͔ͳΓ༗ޮ

۩ମతͳख๏ ϗϫΠτϦετʹΑΔ੍ݶ DPNQMFYJUZʹΑΔ੍ݶ

DPNQMFYJUZʹΑΔ੍ݶ ΫΤϦͷෛՙʹൺྫͯ͠େ͖͘ͳΔ਺஋ʢDPNQMFYJUZʣΛܭࢉ͢Δɻͦͷ਺ ஋͕ᮢ஋Λ௒͑ͨ৔߹͸࣮ߦ͠ͳ͍

DPNQMFYJUZʹΑΔ੍ݶ ΫΤϦͷෛՙʹൺྫͯ͠େ͖͘ͳΔ਺஋ʢDPNQMFYJUZʣΛܭࢉ͢Δɻͦͷ਺ ஋͕ᮢ஋Λ௒͑ͨ৔߹͸࣮ߦ͠ͳ͍ యܕతͳෛՙʹ͍ͭͯDPNQMFYJUZͷྫΛݟ͍ͯ͘ σʔλྔ ܭࢉྔ %#ΞΫηεճ਺ ʢ஫ҙʣDPNQMFYJUZͷܭࢉํ๏͸ແ਺ʹߟ͑ΒΕΔɻࠓ೔ࣔ͢ͷ͸Ұྫ

ྫϊʔυ਺ʹൺྫ͢ΔDPNQMFYJUZ

ྫϊʔυ਺ʹൺྫ͢ΔDPNQMFYJUZ { countries(first: 50) { name cities(first: 100) { name
} } }

ྫϊʔυ਺ʹൺྫ͢ΔDPNQMFYJUZ ϊʔυ਺DPVOUSJFT ºDJUJFT OPEFT { countries(first: 50) { name cities(first:
100) { name } } }

ྫϊʔυ਺ʹൺྫ͢ΔDPNQMFYJUZ ϊʔυ਺DPVOUSJFT ºDJUJFT OPEFT ͜Ε͕ᮢ஋ҎԼͳΒ࣮ߦ͢Δ { countries(first: 50) { name
cities(first: 100) { name } } }

ྫϊʔυ਺ʹൺྫ͢ΔDPNQMFYJUZ ϊʔυ਺DPVOUSJFT ºDJUJFT OPEFT ͜Ε͕ᮢ஋ҎԼͳΒ࣮ߦ͢Δ { countries(first: 50) { name
cities(first: 100) { name } } } ࢀߟ(JU)VC(SBQI2-"1*Wͷ/PEFMJNJU ϊʔυ਺͸ ·Ͱ ϦετͷऔಘͰ͸Ҿ਺ʹpSTU͔MBTU͕ඞਢͰҎ಺

ྫܭࢉίετʹൺྫ͢ΔDPNQMFYJUZ

ྫܭࢉίετʹൺྫ͢ΔDPNQMFYJUZ type City { name superComplexStatistics @cost(n: 10) }

ྫܭࢉίετʹൺྫ͢ΔDPNQMFYJUZ type City { name superComplexStatistics @cost(n: 10) } (SBQI2-ͷEJSFDUJWFΛར༻ͯ͠ɺ
ܕఆٛʢεΩʔϚʣͷଆͰॏ͍ܭࢉʹίετΛ͚ͭΔɻ αʔόʔ͸͜ͷ৘ใΛࢀরͯ͠DPNQMFYJUZΛܭࢉ͢Δ

ܕఆٛʢεΩʔϚʣͷଆͰॏ͍ܭࢉʹίετΛ͚ͭΔɻ αʔόʔ͸͜ͷ৘ใΛࢀরͯ͠DPNQMFYJUZΛܭࢉ͢Δ { countries(first: 100) { cities(first: 100) { superComplexStatistics } } } ΫΤϦ

ܕఆٛʢεΩʔϚʣͷଆͰॏ͍ܭࢉʹίετΛ͚ͭΔɻ αʔόʔ͸͜ͷ৘ใΛࢀরͯ͠DPNQMFYJUZΛܭࢉ͢Δ { countries(first: 100) { cities(first: 100) { superComplexStatistics } } } ܭࢉίετ ºDJUJFT ºDPTU ΫΤϦ

ܕఆٛʢεΩʔϚʣͷଆͰॏ͍ܭࢉʹίετΛ͚ͭΔɻ αʔόʔ͸͜ͷ৘ใΛࢀরͯ͠DPNQMFYJUZΛܭࢉ͢Δ { countries(first: 100) { cities(first: 100) { superComplexStatistics } } } ܭࢉίετ ºDJUJFT ºDPTU ΫΤϦ %#ΞΫηεճ਺΋શ͘ಉ͡ΞΠσΟΞͰDPNQMFYJUZΛઃܭͰ͖Δɻ%#ΞΫ ηε͕ൃੜ͢ΔϑΟʔϧυʹDPTUΛ͚ͭΕ͹ɺ%#ΞΫηεճ਺ʹൺྫͯ͠ DPNQMFYJUZ͕૿Ճ͢ΔΑ͏ʹͰ͖Δɻ

࣮૷ (SBQI2-Ͱྑ͘࢖ΘΕΔݴޠͰ͸ϥΠϒϥϦ౳ͷαϙʔτ͕͋Δ +BWB4DSJQUHSBQIRMDPTUBOBMZTJTͳͲ (PHRMHFO͕αϙʔτ͍ͯ͠Δ αϙʔτͷͳ͍ݴޠͰͲ͏͢Δ͔ ΫΤϦղੳ͚ͩϚΠΫϩαʔϏεͱͯ͠੾Γग़ͯ͠ผݴޠΛ࢖͏ ࣗલͰ࣮૷͢Δ

ମݧஊ ͱ͋ΔαʔϏεͰϑϧεΫϥονͰΫΤϦղੳΛ࣮૷ʢ1FSMͩͬͨͷͰʜʣ εςʔΫϗϧμʔͷҧ͏ΫϥΠΞϯτ͕༧૝͞ΕͨͷͰϗϫΠτϦετʹΑΔ ੍ݶ͸ݟૹͬͨ QBSTFͱFYFDVUFͷؒʹDPNQMFYJUZʹΑΔ੍ݶΛ࢓ࠐΜͩ ϕʔε͸ϊʔυ਺ʹΑΔ੍ݶ શ݅औಘ͢ΔϑΟʔϧυ΍%#ΞΫηε͕ൃੜ͢ΔϑΟʔϧυʹߴΊͷίε τΛ͚ͭΔ ᮢ஋͸௨ৗར༻Λ્֐͠ͳ͍େ͖Ίͷ஋ʹઃఆ ؀ڥม਺Ͱᮢ஋ΛઃఆͰ͖ΔΑ͏ʹͯ͠ૉૣ͘ରॲՄೳʹ

ݱঢ়ͷ՝୊ DPNQMFYJUZͷϕετϓϥΫςΟεཱ͕֬͞Ε͍ͯͳ͍ ࠓճ͸ϊʔυ਺ɾܭࢉίετɾ%#ΞΫηεʹண໨ͯٞ͠࿦Λ͕ͨ͠ɺͦ΋ ͦ΋͜͜·Ͱ౿ΈࠐΜͰٞ࿦͍ͯ͠Δࢿྉ͕গͳ͍ ޙΖʹ%#Ҏ֎͕͍ΔέʔεͳͲଞʹ΋࿦఺͸͋Γͦ͏ ੈͷதͷϥΠϒϥϦ͸DPNQMFYJUZ͕ͻͱͭͷέʔεΛް͘αϙʔτ͍ͯ͠Δ ϊʔυ਺ɾܭࢉίετͱ͍ͬͨෳ਺ͷई౓Λѻ͍ͮΒ͍ ࢓ํͳ͘ͻͱͭͷDPNQMFYJUZʹෳ਺ͷई౓Λԡ͠ࠐΉ͜ͱ΋ +BWB4DSJQUͷHSBQIRMDPTUBOBMZTJTͰ͸࣮ݱՄೳͳ͜ͱΛ֬ೝ

·ͱΊ (SBQI2-Ͱ͸ҙਤతʹෛՙΛ͔͚ΔΫΤϦΛ༰қʹهड़Ͱ͖Δ ͭͷ๷ӴखஈΛ঺հͨ͠ ϗϫΠτϦετʹΑΔ੍ݶ DPNQMFYJUZʹΑΔ੍ݶ ׬ᘳͳ๷Ӵ͸ඞͣ͠΋ඞཁͳ͍ ϦεΫͱରࡦͷશମ૾Λݟ౉͠ཁ݅ʹ͋ͬͨίεύͷྑ͍ํ਑ΛऔΔ ϒϩάهࣄ൛ʮ(SBQI2-"1*Λѱҙ͋ΔΫΤϦ͔ΒकΔख๏ʯ IUUQTZJHBSBTIJIBUFOBCMPHDPNFOUSZHSBQIRMRVFSZBOBMZTJT

GraphQL API を悪意あるクエリから守る手法

GraphQL API を悪意あるクエリから守る手法

More Decks by Yuu Igarashi

Other Decks in Programming

Featured

Transcript