I’ve written previously about some of the issues with using Cosmos DB as a graph database from .NET. One of the more serious issues, I think, is that the documentation doesn’t really demonstrate how to avoid an injection attack when using Gremlin as it presents examples using hard coded strings which are then just picked up and run through the Gremlin.NET library:
// Gremlin queries that will be executed.
private static Dictionary<string, string> gremlinQueries = new Dictionary<string, string>
{
{ "Cleanup", "g.V().drop()" },
{ "AddVertex 1", "g.addV('person').property('id', 'thomas').property('firstName', 'Thomas').property('age', 44)" },
{ "AddVertex 2", "g.addV('person').property('id', 'mary').property('firstName', 'Mary').property('lastName', 'Andersen').property('age', 39)" },
{ "AddVertex 3", "g.addV('person').property('id', 'ben').property('firstName', 'Ben').property('lastName', 'Miller')" },
{ "AddVertex 4", "g.addV('person').property('id', 'robin').property('firstName', 'Robin').property('lastName', 'Wakefield')" },
{ "AddEdge 1", "g.V('thomas').addE('knows').to(g.V('mary'))" },
{ "AddEdge 2", "g.V('thomas').addE('knows').to(g.V('ben'))" },
{ "AddEdge 3", "g.V('ben').addE('knows').to(g.V('robin'))" },
{ "UpdateVertex", "g.V('thomas').property('age', 44)" },
{ "CountVertices", "g.V().count()" },
{ "Filter Range", "g.V().hasLabel('person').has('age', gt(40))" },
{ "Project", "g.V().hasLabel('person').values('firstName')" },
{ "Sort", "g.V().hasLabel('person').order().by('firstName', decr)" },
{ "Traverse", "g.V('thomas').out('knows').hasLabel('person')" },
{ "Traverse 2x", "g.V('thomas').out('knows').hasLabel('person').out('knows').hasLabel('person')" },
{ "Loop", "g.V('thomas').repeat(out()).until(has('id', 'robin')).path()" },
{ "DropEdge", "g.V('thomas').outE('knows').where(inV().has('id', 'mary')).drop()" },
{ "CountEdges", "g.E().count()" },
{ "DropVertex", "g.V('thomas').drop()" },
};
Focusing in on one of the add vertex examples and how it might be executed with the Gremlin.NET library:
private async Task BadExample()
{
using (GremlinClient client = new GremlinClient(_gremlinServer, new GraphSON2Reader(),
new GraphSON2Writer(), GremlinClient.GraphSON2MimeType))
{
await client.SubmitAsync(
"g.addV('person').property('id', 'thomas').property('firstName', 'Thomas').property('age', 44)");
}
}
We know from years of SQL that examples like this quickly become widespread injection prone pieces of code like the below, particularly if people are new to working with a new database (and in the case of graph databases and Gremlin – that’s most people):
private async Task BadExample(string firstName, int age)
{
using (GremlinClient client = new GremlinClient(_gremlinServer, new GraphSON2Reader(),
new GraphSON2Writer(), GremlinClient.GraphSON2MimeType))
{
await client.SubmitAsync(
$"g.addV('person').property('id', '{firstName.ToLower()}').property('firstName', '{firstName}').property('age', {age})");
}
}
The issue, if you’re not familiar with injection attacks, is that as a user I can enter a ‘ character in the input and break out to add my own code through a user interface that executes on the server – for example I could supply a firstName of:
James').property('myinjectedproperty','hahaha got ya
And I’ve managed to attach some data of my own choosing. Obviously I could do more nefarious things too.
Fortunately Gremlin does support parameterised queries and we can rewrite the code above more safely to look like this and leave the libraries and database to take care of this:
private async Task BetterExample(string firstName, int age)
{
using (GremlinClient client = new GremlinClient(_gremlinServer, new GraphSON2Reader(),
new GraphSON2Writer(), GremlinClient.GraphSON2MimeType))
{
Dictionary<string, object> arguments = new Dictionary<string, object>
{
{ "firstNameAsId", firstName.ToLower() },
{ "firstName", firstName },
{ "age", age }
};
await client.SubmitAsync(
$"g.addV('person').property('id', firstNameAsId).property('firstName', firstName).property('age', age)", arguments);
}
}
With the uptake of Cosmos and Graph databases being new to most people I really wish the Cosmos team would update these docs with a security first mindset and its something I’ve fed back to them previously. Leaving the documentation as it stands is almost certainly going to lead to more insecure code being written than would otherwise be the case.
I’ll probably drop out a few short Cosmos posts over the next few days – I’m doing a lot of (quite interesting!) work with it at the moment.
Recent Comments