webAPI retrieveMultipleRecords Query Security

[jham99]

Hello,

In my PCF component code, I use retrieveMultipleRecords and provide it with the optional query string.

Should I be concerned about the security of using a query string? In other words, does the back end that handles this query provide any protections against users running code snippets with malicious queries?

Thanks in advance

[skoofy5]

If your app has no security and it's only by obscurity then no, there's nothing to stop them from running 'malicious' queries to retrieve more records. Though how malicious it is to retrieve more records if you don't apply security roles I'm not sure.

Realistically, your app should be setup with security roles that ensure users access only the appropriate records with the correct privileges (i.e. read/edit/delete/share access). This would prevent users from being able to retrieve records outside of their identified scope.

Additional data protection can be enforced in the form of auditing, capturing potential malicious changes by users. Again, this would need to be configured for your app.

[GuidoPreite]

users can access only records they have the permissions to see by security roles, nothing stops them to open the browser console and execute a retrieveMultipleRecords by themselves bypassing your PCF control completely. your PCF control runs inside the client-side context, not in a server-side context.

[jham99]

Thanks for the responses,

So security roles are the best for protecting records, but if a user can execute retrieveMultipleRecords with arbitrary query strings, then is there any protection against them injecting scripts into these queries? 

[GuidoPreite]

I don't know which protection you are expecting to have. with the security roles you can decide the permissions.

for example if a user can read only its own accounts and can't edit them, if they write a query (or inject your code) they still can't edit the records, client-side or server-side

[jham99]

Alright I see, 

Since the every user environment is isolated from other environments, the only harm that a user could do is to themselves/their own environment? 

[GuidoPreite]

the same user can have access to multiple environments, but under each environment it can have different security roles (for example inside instance A he can create accounts, inside instance B he can only read accounts).

[jham99]

One more question, is there any protection against Denial of Service attacks? A user could only harm their own environments if they did such an attack?

[GuidoPreite]

which exact kind of Denial of Service attacks you are referring to?

[Anonymous]

I think what jham99 is asking about is an arbitrary complex query that could cause lots of resources to be consumed on the server, which may impact billing and or other customers' experiences.

You could think of a regular expression denial of service attack as described https://owasp.org/www-community/attacks/Regular_expression_Denial_of_Service_-_ReDoS

graphQL provides some tools to restrict query complexity as described: https://typegraphql.com/docs/complexity.html

Are there any such mitigations applicable here for untrusted user input being processed by the server?