webAPI retrieveMultipleRecords Query Security

(0) Share

Report

Posted on by jham99

Hello,

In my PCF component code, I use retrieveMultipleRecords and provide it with the optional query string.

Should I be concerned about the security of using a query string? In other words, does the back end that handles this query provide any protections against users running code snippets with malicious queries?

Thanks in advance

Categories:

Power Apps Pro Dev & ISV

I have the same question (0)

All responses (10)

Answers (0)

skoofy5 482 on at

Like (1)

Report
Copy link

Link copied!

If your app has no security and it's only by obscurity then no, there's nothing to stop them from running 'malicious' queries to retrieve more records. Though how malicious it is to retrieve more records if you don't apply security roles I'm not sure.

Realistically, your app should be setup with security roles that ensure users access only the appropriate records with the correct privileges (i.e. read/edit/delete/share access). This would prevent users from being able to retrieve records outside of their identified scope.

Additional data protection can be enforced in the form of auditing, capturing potential malicious changes by users. Again, this would need to be configured for your app.

Was this reply helpful? Yes No
Guido Preite 1,488 Super User 2024 Season 1 on at

Like (1)

Report
Copy link

Link copied!

users can access only records they have the permissions to see by security roles, nothing stops them to open the browser console and execute a retrieveMultipleRecords by themselves bypassing your PCF control completely. your PCF control runs inside the client-side context, not in a server-side context.

Was this reply helpful? Yes No
jham99 8 on at

Like (0)

Report
Copy link

Link copied!

Thanks for the responses,

So security roles are the best for protecting records, but if a user can execute retrieveMultipleRecords with arbitrary query strings, then is there any protection against them injecting scripts into these queries?

Was this reply helpful? Yes No
Guido Preite 1,488 Super User 2024 Season 1 on at

Like (0)

Report
Copy link

Link copied!

I don't know which protection you are expecting to have. with the security roles you can decide the permissions.
for example if a user can read only its own accounts and can't edit them, if they write a query (or inject your code) they still can't edit the records, client-side or server-side

Was this reply helpful? Yes No
jham99 8 on at

Like (0)

Report
Copy link

Link copied!

Alright I see,
Since the every user environment is isolated from other environments, the only harm that a user could do is to themselves/their own environment?

Was this reply helpful? Yes No
Guido Preite 1,488 Super User 2024 Season 1 on at

Like (0)

Report
Copy link

Link copied!

the same user can have access to multiple environments, but under each environment it can have different security roles (for example inside instance A he can create accounts, inside instance B he can only read accounts).

Was this reply helpful? Yes No
jham99 8 on at

Like (0)

Report
Copy link

Link copied!

One more question, is there any protection against Denial of Service attacks? A user could only harm their own environments if they did such an attack?

Was this reply helpful? Yes No
Guido Preite 1,488 Super User 2024 Season 1 on at

Like (0)

Report
Copy link

Link copied!

which exact kind of Denial of Service attacks you are referring to?

Was this reply helpful? Yes No
Community Power Pla... on at

Like (0)

Report
Copy link

Link copied!

I think what jham99 is asking about is an arbitrary complex query that could cause lots of resources to be consumed on the server, which may impact billing and or other customers' experiences.

You could think of a regular expression denial of service attack as described https://owasp.org/www-community/attacks/Regular_expression_Denial_of_Service_-_ReDoS
graphQL provides some tools to restrict query complexity as described: https://typegraphql.com/docs/complexity.html

Are there any such mitigations applicable here for untrusted user input being processed by the server?

Was this reply helpful? Yes No
Guido Preite 1,488 Super User 2024 Season 1 on at

Like (0)

Report
Copy link

Link copied!

as I wrote before, nobody is stopping the user to open the browser console and run 1000000 queries to fetch the accounts
Can this be considered a DDOS? probably not.
Can this impact billing? of course because you are doing a web api call (and authenticated I may add)
Is this connected to the PCF control and the usage of retrieveMultipleRecords and the exploit of this PCF control? absolutely not as the same operation can be done inside the browser console.

Was this reply helpful? Yes No