CVE-2024-39895 (TypeScript, published 2024-07-08T17:15Z)
Description: value: Directus is a real-time API and App dashboard for managing SQL database content. A denial of service (DoS) attack by field duplication in GraphQL is a type of attack where an attacker exploits the flexibility of GraphQL to overwhelm a server by requesting the same field multiple times in a single query. This can cause the server to perform redundant computations and consume excessive resources, leading to a denial of service for legitimate users. Request to the endpoint /graphql are sent when visualizing graphs generated at a dashboard. By modifying the data sent and duplicating many times the fields a DoS attack is possible. This vulnerability is fixed in 10.12.0.
Severity: nan (CVSS v3 base score: )
Weakness: NVD-CWE-noinfo \u2014 Insufficient Information
There is insufficient information about the issue to classify it; details are unkown or unspecified.
Repository: https://github.com/directus/directus
Files changed:
.changeset/flat-kids-jump.md
api/src/middleware/graphql.ts
docs/self-hosted/config-options.md
packages/env/src/constants/defaults.ts
packages/env/src/constants/directus-variables.ts
Commit message: Merge pull request from GHSA-7hmh-pfrp-vcx4

* Add gql parser limit

* Add changeset

* Format docs

---------

Co-authored-by: Pascal Jufer <pascal-jufer@bluewin.ch>

Vulnerable code:
		document = parse(new Source(query));
| Variable                | Description                                                                               | Default Value |
| ----------------------- | ----------------------------------------------------------------------------------------- | ------------- |
| `RELATIONAL_BATCH_SIZE` | How many rows are read into memory at a time when constructing nested relational datasets | 25000         |
| `EXPORT_BATCH_SIZE`     | How many rows are read into memory at a time when constructing exports                    | 5000          |

Fixed code:
---
'@directus/env': patch
'@directus/api': patch
---

Added a configurable max token limit for GraphQL queries
import { useEnv } from '@directus/env';
		const env = useEnv();

		document = parse(new Source(query), {
			maxTokens: Number(env['GRAPHQL_QUERY_TOKEN_LIMIT']),
		});
| Variable                    | Description                                                                                                                     | Default Value |
| --------------------------- | ------------------------------------------------------------------------------------------------------------------------------- | ------------- |
| `RELATIONAL_BATCH_SIZE`     | How many rows are read into memory at a time when constructing nested relational datasets                                       | 25000         |
| `EXPORT_BATCH_SIZE`         | How many rows are read into memory at a time when constructing exports                                                          | 5000          |
| `GRAPHQL_QUERY_TOKEN_LIMIT` | How many GraphQL query tokens will be parsed. [More details here](https://graphql-js.org/api/interface/parseoptions/#maxTokens) | 5000          |
	GRAPHQL_QUERY_TOKEN_LIMIT: 5000,
	'GRAPHQL_QUERY_TOKEN_LIMIT',