fix(orchestrator): Address CVE-2026-3118 (#2597)#2737
fix(orchestrator): Address CVE-2026-3118 (#2597)#2737lholmquist merged 1 commit intoworkspace/orchestratorfrom
Conversation
* fix: Update grapql client * Filters, pagination and queries now use query variables fixes CVE-2026-3118 and relates to JIRA https://redhat.atlassian.net/browse/RHIDP-12388 and https://redhat.atlassian.net/browse/RHIDP-12583
lholmquist
requested review from
batzionb,
gciavarrini and
mareklibra
as code owners
Review Summary by QodoAddress CVE-2026-3118 by implementing GraphQL query variables
WalkthroughsDescription• Migrate GraphQL queries to use query variables instead of string interpolation - Filters, pagination, and queries now use parameterized variables - Prevents GraphQL injection vulnerabilities (CVE-2026-3118) • Refactor filter builder to return structured FilterClause objects - Separates filter clause strings from variable definitions - Enables proper variable substitution in GraphQL queries • Update @urql/core dependency from 4.1.4 to 6.0.1 • Restructure query builder to support query variables for pagination and ordering Diagramflowchart LR
A["Filter/Query Builders"] -->|"Return FilterClause"| B["FilterClause Object"]
B -->|"Contains clause + variables"| C["Query Builder"]
C -->|"Injects variables"| D["GraphQL Query with Parameters"]
D -->|"Passes to client"| E["URQL Client 6.0.1"]
E -->|"Executes safely"| F["Data Index Service"]
File Changes1. workspaces/orchestrator/plugins/orchestrator-backend/src/helpers/filterBuilder.ts
|
Code Review by Qodo
|
|
![rhdh-qodo-merge[bot]](https://avatars.githubusercontent.com/in/1961108?s=60&v=4){kind=small}
| let formattedValue: any; | ||
| let paramType: string; | ||
| if (Array.isArray(binaryFilter.value)) { | ||
| formattedValue = binaryFilter.value.map(v => | ||
| formatValue(binaryFilter.field, v, fieldDef, type), | ||
| ); | ||
| paramType = isEnumFilter(binaryFilter.field, type) | ||
| ? '[ProcessInstanceState!]' | ||
| : '[String!]'; | ||
| } else { | ||
| formattedValue = formatValue( | ||
| binaryFilter.field, | ||
| binaryFilter.value, | ||
| fieldDef, | ||
| type, | ||
| ); | ||
| paramType = 'String'; | ||
| } | ||
|
|
||
| const clauseVariableName = `clauseVariable${nonSecureRandomAlphaNumeric()}`; | ||
| const clause = `${binaryFilter.field}: {${getGraphQLOperator(binaryFilter.operator)}: $${clauseVariableName}}`; | ||
| const filterClauseVariable: FilterClauseVariable = { |
There was a problem hiding this comment.
1. Enum typed as string 🐞 Bug ≡ Correctness
handleBinaryOperator() declares scalar (non-array) filter variables as type String even when isEnumFilter() marks the field (e.g. state) as an enum, which can make the generated GraphQL query invalid due to variable type mismatch. As a result, filtering ProcessInstance.state with EQ can fail at query validation/execution time while IN works (since it uses [ProcessInstanceState!]).
Agent Prompt
### Issue description
`handleBinaryOperator()` generates GraphQL variable declarations for filter values. For enum fields (currently `ProcessInstance.state`), the array path correctly uses an enum type (`[ProcessInstanceState!]`), but the scalar path always uses `String`, which can break GraphQL validation/execution.
### Issue Context
- `isEnumFilter()` marks `state` as an enum field.
- Array enum filters use `[ProcessInstanceState!]`.
- Scalar enum filters currently use `String`.
### Fix Focus Areas
- workspaces/orchestrator/plugins/orchestrator-backend/src/helpers/filterBuilder.ts[164-229]
### What to change
- In the scalar (`else`) branch inside `handleBinaryOperator()`, set `paramType` based on `isEnumFilter(binaryFilter.field, type)` (e.g., `ProcessInstanceState` for `state`) instead of hard-coding `String`.
- (Optional hardening) Centralize enum-type mapping so future enum fields don’t require scattered hard-coded types.
ⓘ Copy this prompt and use it to remediate the issue with your preferred AI generation tools
1 participant
cherry-pick for PR #2597
fix: Update grapql client
Filters, pagination and queries now use query variables
fixes CVE-2026-3118 and relates to JIRA https://redhat.atlassian.net/browse/RHIDP-12388 and https://redhat.atlassian.net/browse/RHIDP-12583
Hey, I just made a Pull Request!
✔️ Checklist