From 69fb975e2161a7b132235103a48d47f80786549b Mon Sep 17 00:00:00 2001 From: abinavsridhar-wk Date: Mon, 19 May 2025 13:09:56 +0200 Subject: [PATCH 1/6] Fix: 29961: Do not propogate SQL query to API response Signed-off-by: abinavsridhar-wk --- .changeset/wicked-socks-share.md | 5 +++++ plugins/search-backend/src/service/router.ts | 11 +++++++++++ 2 files changed, 16 insertions(+) create mode 100644 .changeset/wicked-socks-share.md diff --git a/.changeset/wicked-socks-share.md b/.changeset/wicked-socks-share.md new file mode 100644 index 0000000000..d3e1275732 --- /dev/null +++ b/.changeset/wicked-socks-share.md @@ -0,0 +1,5 @@ +--- +'@backstage/plugin-search-backend': patch +--- + +Error messages should not contain backend SQL query strings in the API response, this change will ensure that messages are logged and empty response is returned to the user diff --git a/plugins/search-backend/src/service/router.ts b/plugins/search-backend/src/service/router.ts index 0ba5eede81..51d32e9e95 100644 --- a/plugins/search-backend/src/service/router.ts +++ b/plugins/search-backend/src/service/router.ts @@ -201,6 +201,17 @@ export async function createRouter( // re-throw and let the default error handler middleware captures it and serializes it with the right response code on the standard form throw error; } + if (query.term.indexOf('<') !== -1) { + // Search queries that contain '<' are likely to be a SQL injection attack, log the error and return an empty response + const message = (error as any)?.message || ''; + if ( + typeof message === 'string' && + message.indexOf('syntax error in tsquery') !== -1 + ) { + logger.info('Search query skipped due to tsquery syntax error.'); + return; // Do not throw an error and just skip the search + } + } throw new Error( `There was a problem performing the search query: ${error.message}`, From 5ea47166b28d5e0a7ea6667e602fd098364515c0 Mon Sep 17 00:00:00 2001 From: abinavsridhar-wk Date: Wed, 21 May 2025 16:20:21 +0200 Subject: [PATCH 2/6] Address comments Signed-off-by: abinavsridhar-wk --- plugins/search-backend/src/service/router.ts | 20 ++++++-------------- 1 file changed, 6 insertions(+), 14 deletions(-) diff --git a/plugins/search-backend/src/service/router.ts b/plugins/search-backend/src/service/router.ts index 51d32e9e95..eedd84105a 100644 --- a/plugins/search-backend/src/service/router.ts +++ b/plugins/search-backend/src/service/router.ts @@ -197,25 +197,17 @@ export async function createRouter( res.json(filterResultSet(toSearchResults(resultSet))); } catch (error) { + // Log the error message here, but don't expose it to the user in the response + logger.error( + `There was a problem performing the search query: ${error.message}`, + ); if (error.name === 'MissingIndexError') { // re-throw and let the default error handler middleware captures it and serializes it with the right response code on the standard form throw error; } - if (query.term.indexOf('<') !== -1) { - // Search queries that contain '<' are likely to be a SQL injection attack, log the error and return an empty response - const message = (error as any)?.message || ''; - if ( - typeof message === 'string' && - message.indexOf('syntax error in tsquery') !== -1 - ) { - logger.info('Search query skipped due to tsquery syntax error.'); - return; // Do not throw an error and just skip the search - } - } - throw new Error( - `There was a problem performing the search query: ${error.message}`, - ); + // If the error is not a MissingIndexError, we want to throw a generic error without the error message as it may leak internal information + throw new Error(`There was a problem performing the search query`); } }); From a365cbacf289fccc0f356bf4a9cdc7f61a9bccc5 Mon Sep 17 00:00:00 2001 From: abinavsridhar-wk Date: Sat, 7 Jun 2025 19:57:22 +0200 Subject: [PATCH 3/6] Fix test cases Signed-off-by: abinavsridhar-wk --- plugins/search-backend/src/service/router.test.ts | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/plugins/search-backend/src/service/router.test.ts b/plugins/search-backend/src/service/router.test.ts index 5aea71b7c1..623b78016a 100644 --- a/plugins/search-backend/src/service/router.test.ts +++ b/plugins/search-backend/src/service/router.test.ts @@ -106,7 +106,7 @@ describe('createRouter', () => { expect.objectContaining({ error: { name: 'Error', - message: `There was a problem performing the search query: ${error.message}`, + message: `There was a problem performing the search query`, }, }), ); From 396c27fe2e8980dd1d83076d383365cf2835e6db Mon Sep 17 00:00:00 2001 From: "renovate[bot]" <29139614+renovate[bot]@users.noreply.github.com> Date: Mon, 23 Jun 2025 19:55:10 +0000 Subject: [PATCH 4/6] Update dependency @modelcontextprotocol/sdk to v1.13.1 Signed-off-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com> --- yarn.lock | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/yarn.lock b/yarn.lock index df059419ed..3e0eded695 100644 --- a/yarn.lock +++ b/yarn.lock @@ -11769,8 +11769,8 @@ __metadata: linkType: hard "@modelcontextprotocol/sdk@npm:^1.12.3": - version: 1.12.3 - resolution: "@modelcontextprotocol/sdk@npm:1.12.3" + version: 1.13.1 + resolution: "@modelcontextprotocol/sdk@npm:1.13.1" dependencies: ajv: "npm:^6.12.6" content-type: "npm:^1.0.5" @@ -11783,7 +11783,7 @@ __metadata: raw-body: "npm:^3.0.0" zod: "npm:^3.23.8" zod-to-json-schema: "npm:^3.24.1" - checksum: 10/abab9b3fcce45370aadc260e9f02587308455ea907cf58b5e7f2e27c0ef4d19bf591f80284592b69f3d1656e4b362b2a96788eb1492daa3e7e2129c49b3eea98 + checksum: 10/b516d72e1cd14c67c8a2e5cb95fcc1c03c50be989850e3e963a7ed11000acb604e65efeaad47ea93c847130536ee51859a8d34e6dbe99d408e1a24224592e57f languageName: node linkType: hard From 62dce513d8bdff8197a26de4b01a1cd48a0c308e Mon Sep 17 00:00:00 2001 From: "renovate[bot]" <29139614+renovate[bot]@users.noreply.github.com> Date: Mon, 23 Jun 2025 20:10:52 +0000 Subject: [PATCH 5/6] Update dependency @slack/web-api to v7.9.3 Signed-off-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com> --- yarn.lock | 10 +++++----- 1 file changed, 5 insertions(+), 5 deletions(-) diff --git a/yarn.lock b/yarn.lock index df059419ed..9bfd55c74e 100644 --- a/yarn.lock +++ b/yarn.lock @@ -18264,14 +18264,14 @@ __metadata: linkType: hard "@slack/web-api@npm:^7.5.0": - version: 7.8.0 - resolution: "@slack/web-api@npm:7.8.0" + version: 7.9.3 + resolution: "@slack/web-api@npm:7.9.3" dependencies: "@slack/logger": "npm:^4.0.0" "@slack/types": "npm:^2.9.0" "@types/node": "npm:>=18.0.0" "@types/retry": "npm:0.12.0" - axios: "npm:^1.7.8" + axios: "npm:^1.8.3" eventemitter3: "npm:^5.0.1" form-data: "npm:^4.0.0" is-electron: "npm:2.2.2" @@ -18279,7 +18279,7 @@ __metadata: p-queue: "npm:^6" p-retry: "npm:^4" retry: "npm:^0.13.1" - checksum: 10/f2a698f853d0aaab11a23e9ce659e2cf3e43792eeb6861ef05258bbd2bb5cfe3bad8fc7bff4ee6fe471e67ec9fb6b22ef16be4478ab68f139df730337ebe15bb + checksum: 10/dc8aa95c8127a1155f0c0756bc819185da0b471feb5953dc118301e577e67f45ad4ef64d9459ff430b44f769344a6347d1636ad59267483e9ac0104611263a05 languageName: node linkType: hard @@ -25485,7 +25485,7 @@ __metadata: languageName: node linkType: hard -"axios@npm:^1.0.0, axios@npm:^1.6.0, axios@npm:^1.7.4, axios@npm:^1.7.7, axios@npm:^1.7.8": +"axios@npm:^1.0.0, axios@npm:^1.6.0, axios@npm:^1.7.4, axios@npm:^1.7.7, axios@npm:^1.8.3": version: 1.10.0 resolution: "axios@npm:1.10.0" dependencies: From 441f914c81f48c05640b5611a950a04b3a7b2eb9 Mon Sep 17 00:00:00 2001 From: "renovate[bot]" <29139614+renovate[bot]@users.noreply.github.com> Date: Mon, 23 Jun 2025 20:44:40 +0000 Subject: [PATCH 6/6] Update dependency @stoplight/spectral-core to v1.20.0 Signed-off-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com> --- yarn.lock | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/yarn.lock b/yarn.lock index 3e0eded695..06997cb8d2 100644 --- a/yarn.lock +++ b/yarn.lock @@ -19086,8 +19086,8 @@ __metadata: linkType: hard "@stoplight/spectral-core@npm:^1.18.0, @stoplight/spectral-core@npm:^1.18.3, @stoplight/spectral-core@npm:^1.19.2, @stoplight/spectral-core@npm:^1.19.4, @stoplight/spectral-core@npm:^1.8.1": - version: 1.19.5 - resolution: "@stoplight/spectral-core@npm:1.19.5" + version: 1.20.0 + resolution: "@stoplight/spectral-core@npm:1.20.0" dependencies: "@stoplight/better-ajv-errors": "npm:1.0.3" "@stoplight/json": "npm:~3.21.0" @@ -19110,7 +19110,7 @@ __metadata: pony-cause: "npm:^1.1.1" simple-eval: "npm:1.0.1" tslib: "npm:^2.8.1" - checksum: 10/db0f6c1c0ca67bc4a49c480259d261283ccb72958cd3a2a761dccbbbb1fdd04911df9c0a05f7ce4453e303de737206fbf3e799a1ace5db49d433a2848abe13b2 + checksum: 10/63628dcf4b1556db166a020dd78d17033908fa7d1c67c62739e35848e5d0e095714524b4c142aa7d6524fe556152f4dbb8cb388b36bc6e37026bf07c31a0e69b languageName: node linkType: hard