GraphQL to terminate the request even if it was active

[phillip-kruger]

Fix #26748
(Again)

Thanks @cescoffier for the help :)

Signed-off-by: Phillip Kruger [email protected]

[gsmet]

Hmmm, too bad we missed it when reviewing. I'm wondering what I should do:

1. release a 2.10.4.Final? yes/no
2. skip 2.11.0.Final and release a 2.11.1.Final tomorrow with the fix? yes/no

If we do 2/, we could skip 1/ but we might want to release a 2.10.4.Final with just this fix to have a safe upgrade target for users of 2.10?

Other option is to just wait for 2.11.1.Final in a week or so but I don't think it's acceptable.

/cc @geoand

[geoand]

If we do 2/, we could skip 1/ but we might want to release a 2.10.4.Final with just this fix to have a safe upgrade target for users of 2.10?

I prefer this solution.

[gsmet]

@geoand so release both 2.10.4.Final and 2.11.1.Final?

[geoand]

Yeah, I think given the severity of this, it's the best thing to do.

[gsmet]

Agreed even if I'm not terribly excited about it :).

[quarkus-bot]

Failing Jobs - Building 08e5c31

Status	Name	Step	Failures	Logs	Raw logs
✔️	Gradle Tests - JDK 11
✖	Gradle Tests - JDK 11 Windows	Build	Failures	Logs	Raw logs

Full information is available in the Build summary check run.

Failures

⚙️ Gradle Tests - JDK 11 Windows #

- Failing: integration-tests/gradle 

📦 integration-tests/gradle

✖ io.quarkus.gradle.devmode.CompositeBuildWithDependenciesDevModeTest.main line 24 - More details - Source on GitHub

org.awaitility.core.ConditionTimeoutException: Condition with lambda expression in io.quarkus.test.devmode.util.DevModeTestUtils that uses java.util.function.Supplier, java.util.function.Supplierjava.util.concurrent.atomic.AtomicReference, java.util.concurrent.atomic.AtomicReferencejava.lang.String, java.lang.Stringboolean was not fulfilled within 1 minutes.
	at org.awaitility.core.ConditionAwaiter.await(ConditionAwaiter.java:167)
	at org.awaitility.core.CallableCondition.await(CallableCondition.java:78)

[quarkus-bot]

Milestone is already set for some of the items:

• Issue CVE-2022-2466 - Request Context not terminated with GraphQL #26748

We haven't automatically updated the milestones for these items.

This message is automatically generated by a bot.

[gsmet]

Next time, let's avoid to shoe in this type of change in a security fix as this is not backportable to 2.10.

[gsmet]

(I fixed it, no need for additional work on your side)