Bypass GraphQL rate limit by abusing negative cost queries
该报告还没有中文解读。
原文摘录
摘自原文(2043 字符中的一小部分)
While looking into the graphql app I noticed an interesting implementation where each app has a bucket of query cost they are allowed to used in a given time with a certain refresh rate associated with it.
原文中的代码
{
appInstallations(first: 10) {
edges {
node {
id
uninstallUrl
accessScopes {
description
handle
}
accessScopes {
description
handle
}
accessScopes {
description
handle …默认不展示报告全文。以上为简短摘录,完整复现过程请阅读原文。版权归研究员与 Shopify 所有。
时间线
- 报告提交
- 公开披露
阅读 HackerOne 原文 ↗作者 @emitrani · 版权归作者与 Shopify 所有