[RMB-534] Reject CQL queries that match no index in schema.json - FOLIO Issue Tracker

XML

Word

Printable

We've had warnings for some time, but since that's not relayed back to a client this
has not prevented slow queries from popping up.

This also allows some endpoint to return a list of valid indexes and relations allowed.

Since users can use arbitrary fields and, thus, cause RMB-based modules to perform sequental scan, this is a very easy to perform denial-of-service attack.. Inventory front-end has the "Query search" slot where the user can enter any CQL: https://folio-snapshot.aws.indexdata.com/inventory?qindex=querySearch&sort=Title

relates to

FOLIO-2563 SPIKE: propose prevention of DoS via CQL query

FOLIO-2524 Security Audit raised issues

FOLIO-2573 Paused due to POC of Elastic Search. All Search Options Should be Supported by a Database Index

RMB-533 Performance: Fix lower/f_unaccent usage by checking all 5 index types

RMB-791 Explain scheme.json / Report supported CQL

Reject CQL queries that match no index in schema.json