fix CVE-2026-3118 by lholmquist · Pull Request #2597 · redhat-developer/rhdh-plugins

lholmquist · 2026-03-24T13:13:38Z

Hey, I just made a Pull Request!

relates to JIRA https://redhat.atlassian.net/browse/RHIDP-12388 and https://redhat.atlassian.net/browse/RHIDP-12583

The orchestrator plugin uses this graphql client: @urql/core, which has a dependecy on this module, @0no-co/graphql.web, which was not correctly parsing the constructed graphql queries during execution when resolving to version 1.0.9. Updating to the latest @urql/core brings in an updated version of @0no-co/graphql.web which parses those queries correctly and will now throw an error when a query is malformed(happening during a malformed pagination example) and sanitize query filters

This PR also reworks the code that builds the query and the various filters. It now will take advantage of using query variables: https://graphql.org/learn/queries/#variables which should guard it from injection attacks

This will also need to be applied to both the 1.8 and 1.9 branches for orchestrator

✔️ Checklist

A changeset describing the change and affected packages. (more info)
Added or Updated documentation
Tests for new functionality and regression tests for bug fixes
Screenshots attached (for UI changes)

rhdh-qodo-merge · 2026-03-24T13:13:53Z

Review Summary by Qodo

Update @urql/core to fix CVE-2026-3118 vulnerability

🐞 Bug fix

Walkthroughs

Description

• Update @urql/core dependency from 4.1.4 to 6.0.1
• Fixes CVE-2026-3118 vulnerability in GraphQL query parsing
• Resolves malformed pagination query handling issues
• Add changeset documenting the patch version update

Diagram

flowchart LR
  A["@urql/core v4.1.4"] -- "Update to v6.0.1" --> B["Fixed CVE-2026-3118"]
  B -- "Improved query parsing" --> C["@0no-co/graphql.web updated"]
  C -- "Sanitizes filters" --> D["Malformed queries detected"]

File Changes

1. workspaces/orchestrator/.changeset/five-meals-cover.md 📝 Documentation +5/-0

Add changeset for CVE-2026-3118 patch

• Created new changeset file documenting the patch update
• Specifies affected package: @red-hat-developer-hub/backstage-plugin-orchestrator-backend
• Documents CVE-2026-3118 fix for @urql/core dependency

workspaces/orchestrator/.changeset/five-meals-cover.md

2. workspaces/orchestrator/plugins/orchestrator-backend/package.json 🐞 Bug fix +1/-1

Upgrade @urql/core dependency to v6.0.1
• Upgraded @urql/core from ^4.1.4 to ^6.0.1
• Brings in updated @0no-co/graphql.web for proper query parsing
• Fixes vulnerability and improves malformed query error handling
workspaces/orchestrator/plugins/orchestrator-backend/package.json

rhdh-qodo-merge · 2026-03-24T13:13:55Z

Code Review by Qodo

🐞 Bugs (2) 📘 Rule violations (0) 📎 Requirement gaps (0) 📐 Spec deviations (0)

1. GraphQL filter injection risk 🐞 Bug ⛨ Security

Description

Request-body filters values are inserted into GraphQL query strings without escaping, so
quotes/braces in filter values can break query parsing and allow query-shape injection against the
Data Index GraphQL endpoint. This becomes more user-visible with the @urql/core upgrade because
malformed queries will error instead of being tolerated downstream.

Code

workspaces/orchestrator/plugins/orchestrator-backend/package.json[79]
+    "@urql/core": "^6.0.1",

Evidence
The backend accepts req.body.filters and forwards it into query building. filterBuilder formats
values as "${fieldValue}" without escaping, and DataIndexService/queryBuilder send the
resulting string to client.query(...), so malicious or simply unescaped input (e.g., containing
") can create invalid GraphQL or alter the query structure.
workspaces/orchestrator/plugins/orchestrator-backend/src/service/router.ts[1098-1100]
workspaces/orchestrator/plugins/orchestrator-backend/src/helpers/filterBuilder.ts[147-155]
workspaces/orchestrator/plugins/orchestrator-backend/src/helpers/filterBuilder.ts[251-277]
workspaces/orchestrator/plugins/orchestrator-backend/src/helpers/queryBuilder.ts[18-38]
workspaces/orchestrator/plugins/orchestrator-backend/src/service/DataIndexService.ts[205-254]

Agent prompt

The issue below was found during a code review. Follow the provided context and guidance below and implement a solution

### Issue description
`filters` coming from `req.body` are embedded into GraphQL query strings without escaping, which can break query parsing and enables query-shape injection.

### Issue Context
- `router.ts` returns request filters directly from the body.
- `filterBuilder.ts` wraps string values in quotes without escaping.
- Queries are executed by passing constructed strings into `@urql/core`.

### Fix Focus Areas
- Sanitize/escape GraphQL string literal values (at minimum via `JSON.stringify(String(value))`) before embedding them into query strings.
- Prefer GraphQL variables wherever possible (for values like `definitionId`, `instanceId`, and filter values).
- Validate filter objects from the request (shape + value types) and reject invalid characters if variables cannot be used.

#### Files/lines
- workspaces/orchestrator/plugins/orchestrator-backend/src/service/router.ts[1098-1100]
- workspaces/orchestrator/plugins/orchestrator-backend/src/helpers/filterBuilder.ts[101-155]
- workspaces/orchestrator/plugins/orchestrator-backend/src/helpers/filterBuilder.ts[251-277]
- workspaces/orchestrator/plugins/orchestrator-backend/src/service/DataIndexService.ts[132-153]
- workspaces/orchestrator/plugins/orchestrator-backend/src/service/DataIndexService.ts[404-454]
- workspaces/orchestrator/plugins/orchestrator-backend/src/helpers/queryBuilder.ts[18-38]

ⓘ Copy this prompt and use it to remediate the issue with your preferred AI generation tools

2. Changeset typo 🐞 Bug ⚙ Maintainability

Description

The changeset text contains a spelling error (“dependecy”), which will be published in release
notes/changelog output. This is user-facing metadata and should be corrected before release
automation consumes it.

Code

workspaces/orchestrator/.changeset/five-meals-cover.md[5]
+Update dependecy @urql/core to fix CVE-2026-3118

Evidence
The new changeset file’s summary line includes the misspelling verbatim.
workspaces/orchestrator/.changeset/five-meals-cover.md[1-5]

Agent prompt

The issue below was found during a code review. Follow the provided context and guidance below and implement a solution

### Issue description
Changeset summary contains a typo.

### Fix Focus Areas
- Replace `dependecy` with `dependency`.

#### Files/lines
- workspaces/orchestrator/.changeset/five-meals-cover.md[1-5]

ⓘ Copy this prompt and use it to remediate the issue with your preferred AI generation tools

ⓘ The new review experience is currently in Beta. Learn more

rhdh-gh-app · 2026-03-24T13:14:04Z

Changed Packages

Package Name	Package Path	Changeset Bump	Current Version
@red-hat-developer-hub/backstage-plugin-orchestrator-backend	workspaces/orchestrator/plugins/orchestrator-backend	patch	`v8.7.2`

rhdh-qodo-merge · 2026-03-24T13:25:30Z

    "@red-hat-developer-hub/backstage-plugin-orchestrator-common": "workspace:^",
    "@red-hat-developer-hub/backstage-plugin-orchestrator-node": "workspace:^",
-    "@urql/core": "^4.1.4",
+    "@urql/core": "^6.0.1",


1. Graphql filter injection risk 🐞 Bug ⛨ Security

Request-body filters values are inserted into GraphQL query strings without escaping, so quotes/braces in filter values can break query parsing and allow query-shape injection against the Data Index GraphQL endpoint. This becomes more user-visible with the @urql/core upgrade because malformed queries will error instead of being tolerated downstream.

Agent Prompt

### Issue description `filters` coming from `req.body` are embedded into GraphQL query strings without escaping, which can break query parsing and enables query-shape injection. ### Issue Context - `router.ts` returns request filters directly from the body. - `filterBuilder.ts` wraps string values in quotes without escaping. - Queries are executed by passing constructed strings into `@urql/core`. ### Fix Focus Areas - Sanitize/escape GraphQL string literal values (at minimum via `JSON.stringify(String(value))`) before embedding them into query strings. - Prefer GraphQL variables wherever possible (for values like `definitionId`, `instanceId`, and filter values). - Validate filter objects from the request (shape + value types) and reject invalid characters if variables cannot be used. #### Files/lines - workspaces/orchestrator/plugins/orchestrator-backend/src/service/router.ts[1098-1100] - workspaces/orchestrator/plugins/orchestrator-backend/src/helpers/filterBuilder.ts[101-155] - workspaces/orchestrator/plugins/orchestrator-backend/src/helpers/filterBuilder.ts[251-277] - workspaces/orchestrator/plugins/orchestrator-backend/src/service/DataIndexService.ts[132-153] - workspaces/orchestrator/plugins/orchestrator-backend/src/service/DataIndexService.ts[404-454] - workspaces/orchestrator/plugins/orchestrator-backend/src/helpers/queryBuilder.ts[18-38]

ⓘ Copy this prompt and use it to remediate the issue with your preferred AI generation tools

relates to JIRA https://redhat.atlassian.net/browse/RHIDP-12388 and https://redhat.atlassian.net/browse/RHIDP-12583

…ogic. ugh

PatAKnight

Last one and then this should be good to go!

sonarqubecloud · 2026-04-08T14:54:25Z

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

PatAKnight

/lgtm

lholmquist · 2026-04-08T15:34:06Z

/cherrypick orchestrator-1.8

openshift-cherrypick-robot · 2026-04-08T15:35:17Z

@lholmquist: #2597 failed to apply on top of branch "orchestrator-1.8":

Applying: fix: Update grapql client to fix CVE-2026-3118.
Using index info to reconstruct a base tree...
M	workspaces/orchestrator/plugins/orchestrator-backend/package.json
M	workspaces/orchestrator/yarn.lock
Falling back to patching base and 3-way merge...
Auto-merging workspaces/orchestrator/yarn.lock
CONFLICT (content): Merge conflict in workspaces/orchestrator/yarn.lock
Auto-merging workspaces/orchestrator/plugins/orchestrator-backend/package.json
CONFLICT (content): Merge conflict in workspaces/orchestrator/plugins/orchestrator-backend/package.json
error: Failed to merge in the changes.
hint: Use 'git am --show-current-patch=diff' to see the failed patch
hint: When you have resolved this problem, run "git am --continue".
hint: If you prefer to skip this patch, run "git am --skip" instead.
hint: To restore the original branch and stop patching, run "git am --abort".
hint: Disable this message with "git config set advice.mergeConflict false"
Patch failed at 0001 fix: Update grapql client to fix CVE-2026-3118.

Details

In response to this:

/cherrypick orchestrator-1.8

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository.

* fix: Update grapql client * Filters, pagination and queries now use query variables fixes CVE-2026-3118 and relates to JIRA https://redhat.atlassian.net/browse/RHIDP-12388 and https://redhat.atlassian.net/browse/RHIDP-12583

lholmquist · 2026-04-08T15:51:11Z

/cherrypick orchestrator-1.9

openshift-cherrypick-robot · 2026-04-08T15:51:52Z

@lholmquist: #2597 failed to apply on top of branch "orchestrator-1.9":

Applying: fix: Update grapql client to fix CVE-2026-3118.
Using index info to reconstruct a base tree...
M	workspaces/orchestrator/plugins/orchestrator-backend/package.json
M	workspaces/orchestrator/yarn.lock
Falling back to patching base and 3-way merge...
Auto-merging workspaces/orchestrator/yarn.lock
CONFLICT (content): Merge conflict in workspaces/orchestrator/yarn.lock
Auto-merging workspaces/orchestrator/plugins/orchestrator-backend/package.json
error: Failed to merge in the changes.
hint: Use 'git am --show-current-patch=diff' to see the failed patch
hint: When you have resolved this problem, run "git am --continue".
hint: If you prefer to skip this patch, run "git am --skip" instead.
hint: To restore the original branch and stop patching, run "git am --abort".
hint: Disable this message with "git config set advice.mergeConflict false"
Patch failed at 0001 fix: Update grapql client to fix CVE-2026-3118.

Details

In response to this:

/cherrypick orchestrator-1.9

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository.

* fix: Update grapql client * Filters, pagination and queries now use query variables fixes CVE-2026-3118 and relates to JIRA https://redhat.atlassian.net/browse/RHIDP-12388 and https://redhat.atlassian.net/browse/RHIDP-12583

lholmquist requested review from a team, christoph-jerolimov, karthikjeeyar and lokanandaprabhu as code owners March 24, 2026 13:13

rhdh-qodo-merge bot reviewed Mar 24, 2026

View reviewed changes

lholmquist added the do-not-merge/hold label Mar 24, 2026

lholmquist changed the title ~~fix: Update grapql client to fix CVE-2026-3118~~ WIP: fix CVE-2026-3118 Mar 25, 2026

openshift-ci bot added the do-not-merge/work-in-progress label Mar 25, 2026

lholmquist force-pushed the RHIDP-12388-CVE-2026-3118 branch 2 times, most recently from 28dcf48 to 97ea3f6 Compare April 3, 2026 17:19

lholmquist changed the title ~~WIP: fix CVE-2026-3118~~ fix CVE-2026-3118 Apr 3, 2026

openshift-ci bot removed the do-not-merge/work-in-progress label Apr 3, 2026

lholmquist removed the do-not-merge/hold label Apr 3, 2026

lholmquist added 10 commits April 7, 2026 07:57

fix: Update grapql client to fix CVE-2026-3118.

7d8a88a

relates to JIRA https://redhat.atlassian.net/browse/RHIDP-12388 and https://redhat.atlassian.net/browse/RHIDP-12583

squash: add changeset

7045d7a

squash: pagination now using query variables. Next up is the filter l…

7ce9aad

…ogic. ugh

squash: fix tsc errors

c78bf36

squash: just saving this off for now, go get this later

dcdadcc

squash: almost there, need to fix some tests

727d730

squash: updating the tests

1d6c99b

squash: better random alpha

24e6c63

squash: some code cleanup

87925cb

squash: update the changeset

d1c9787

lholmquist force-pushed the RHIDP-12388-CVE-2026-3118 branch from 97ea3f6 to d1c9787 Compare April 7, 2026 11:58

PatAKnight reviewed Apr 7, 2026

View reviewed changes

lholmquist added 2 commits April 7, 2026 10:13

squash: remove stray console.log

755e87b

squash: some type cleanup and random function cleanup

81ffd88

lholmquist added 2 commits April 7, 2026 11:09

squash: fix negation sonar issu

1de21c5

squash: more sonarcube fixes

9afe698

lholmquist force-pushed the RHIDP-12388-CVE-2026-3118 branch from 0f5572b to 9afe698 Compare April 7, 2026 15:26

lholmquist added 3 commits April 7, 2026 11:31

squash .

df6c68b

squash: use query variables on the other functions

95c5d7e

squash: fix query if an enum with state

1620db1

PatAKnight reviewed Apr 8, 2026

View reviewed changes

Comment thread workspaces/orchestrator/plugins/orchestrator-backend/src/service/DataIndexService.ts Outdated

squash: fix issue with targetEntity query

07724c0

PatAKnight approved these changes Apr 8, 2026

View reviewed changes

openshift-ci bot assigned PatAKnight Apr 8, 2026

openshift-ci bot added the lgtm label Apr 8, 2026

lholmquist merged commit 91013e2 into redhat-developer:main Apr 8, 2026
11 checks passed

lholmquist mentioned this pull request Apr 9, 2026

fix(orchestrator): Address CVE-2026-3118 (#2597) #2736

Merged

4 tasks

lholmquist mentioned this pull request Apr 9, 2026

fix(orchestrator): Address CVE-2026-3118 (#2597) #2737

Merged

4 tasks

rhdh-qodo-merge bot mentioned this pull request Apr 16, 2026

fix(orchestrator): makes the bodyParser limit configurable. #2802

Merged

4 tasks

Conversation

lholmquist commented Mar 24, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Hey, I just made a Pull Request!

✔️ Checklist

Uh oh!

rhdh-qodo-merge bot commented Mar 24, 2026

Review Summary by Qodo

Walkthroughs

File Changes

Uh oh!

rhdh-qodo-merge bot commented Mar 24, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Code Review by Qodo

Uh oh!

rhdh-gh-app bot commented Mar 24, 2026

Changed Packages

Uh oh!

rhdh-qodo-merge bot Mar 24, 2026

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

PatAKnight left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

sonarqubecloud bot commented Apr 8, 2026

Quality Gate passed

Uh oh!

PatAKnight left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

lholmquist commented Apr 8, 2026

Uh oh!

openshift-cherrypick-robot commented Apr 8, 2026

Uh oh!

lholmquist commented Apr 8, 2026

Uh oh!

openshift-cherrypick-robot commented Apr 8, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

lholmquist commented Mar 24, 2026 •

edited

Loading

rhdh-qodo-merge bot commented Mar 24, 2026 •

edited

Loading