Manual Cherry pick to 1.8 - fix(orchestrator): Address CVE-2026-3118 (#2597)

[lholmquist]

This is the cherry-pick of 91013e2

I had to manually do it since there was a conflict when trying with the automation

• fix: Update grapql client

• Filters, pagination and queries now use query variables

fixes CVE-2026-3118 and relates to JIRA https://redhat.atlassian.net/browse/RHIDP-12388 and https://redhat.atlassian.net/browse/RHIDP-12583

Hey, I just made a Pull Request!

✔️ Checklist

• A changeset describing the change and affected packages. (more info)
• Added or Updated documentation
• Tests for new functionality and regression tests for bug fixes
• Screenshots attached (for UI changes)

[rhdh-qodo-merge]

Review Summary by Qodo

Fix CVE-2026-3118 by migrating GraphQL queries to use parameterized variables

🐞 Bug fix ✨ Enhancement

Walkthroughs

Description

• Migrate GraphQL queries to use parameterized variables instead of string interpolation
  - Filter builder now returns FilterClause objects with separated clause and variables
  - Query builder updated to accept and process filter condition variables
  - Pagination and orderBy now use query variables
• Update @urql/core dependency from 4.1.4 to 6.0.1 to address CVE-2026-3118
• Refactor filter and query building to support secure GraphQL variable passing
  - Add FilterClause and FilterClauseVariable types for structured variable handling
  - Update all GraphQL queries to use gql template literals with variables
• Comprehensive test updates to validate new variable-based filtering approach

Diagram

flowchart LR
  A["Filter/Query Builders"] -- "String Interpolation" --> B["Vulnerable GraphQL Queries"]
  C["Updated Builders"] -- "Query Variables" --> D["Secure GraphQL Queries"]
  E["@urql/core 4.1.4"] -- "CVE-2026-3118" --> F["Security Vulnerability"]
  G["@urql/core 6.0.1"] -- "Patched" --> H["Vulnerability Fixed"]
  A --> C
  E --> G

Loading

File Changes

1. workspaces/orchestrator/plugins/orchestrator-backend/src/helpers/filterBuilder.ts ✨ Enhancement +105/-25

Refactor filter builder to use query variables

workspaces/orchestrator/plugins/orchestrator-backend/src/helpers/filterBuilder.ts

---

2. workspaces/orchestrator/plugins/orchestrator-backend/src/helpers/filterBuilders.test.ts 🧪 Tests +156/-46

Update filter builder tests for variable-based approach

workspaces/orchestrator/plugins/orchestrator-backend/src/helpers/filterBuilders.test.ts

---

3. workspaces/orchestrator/plugins/orchestrator-backend/src/helpers/queryBuilder.ts ✨ Enhancement +63/-25

Migrate query builder to parameterized GraphQL variables

workspaces/orchestrator/plugins/orchestrator-backend/src/helpers/queryBuilder.ts

---

View more (7)

4. workspaces/orchestrator/plugins/orchestrator-backend/src/helpers/queryBuilder.test.ts 🧪 Tests +7/-18

Update query builder tests for variable parameters

workspaces/orchestrator/plugins/orchestrator-backend/src/helpers/queryBuilder.test.ts

---

5. workspaces/orchestrator/plugins/orchestrator-backend/src/service/DataIndexService.ts ✨ Enhancement +102/-22

Integrate variable-based filters and queries throughout service

workspaces/orchestrator/plugins/orchestrator-backend/src/service/DataIndexService.ts

---

6. workspaces/orchestrator/plugins/orchestrator-backend/src/service/DataIndexService.test.ts 🧪 Tests +197/-93

Update DataIndexService tests for new variable handling

workspaces/orchestrator/plugins/orchestrator-backend/src/service/DataIndexService.test.ts

---

7. workspaces/orchestrator/plugins/orchestrator-backend/src/types/filterClause.ts ✨ Enhancement +26/-0

Add new FilterClause and FilterClauseVariable types

workspaces/orchestrator/plugins/orchestrator-backend/src/types/filterClause.ts

---

8. workspaces/orchestrator/plugins/orchestrator-backend/src/types/pagination.ts ✨ Enhancement +7/-1

Add PaginationQueryVariable type for query parameters

workspaces/orchestrator/plugins/orchestrator-backend/src/types/pagination.ts

---

9. workspaces/orchestrator/plugins/orchestrator-backend/package.json Dependencies +1/-1

Update @urql/core dependency to 6.0.1

workspaces/orchestrator/plugins/orchestrator-backend/package.json

---

10. workspaces/orchestrator/.changeset/five-meals-cover.md 📝 Documentation +6/-0

Document CVE fix and query variable refactoring

workspaces/orchestrator/.changeset/five-meals-cover.md

---

[rhdh-qodo-merge]

Code Review by Qodo

🐞 Bugs (1)   📘 Rule violations (0)   📎 Requirement gaps (0)   🎨 UX Issues (0)

🐞\ ≡ Correctness (1)

1. Enum EQ typed as String 🐞 ≡

Description

handleBinaryOperator always sets scalar filter variables to type String, even when filtering the
enum field state, while the array case uses [ProcessInstanceState!]. This inconsistency can
produce invalid GraphQL variable declarations for state equality filters and cause query
validation failures when state filtering is used.

Code

workspaces/orchestrator/plugins/orchestrator-backend/src/helpers/filterBuilder.ts[R195-216]

+  let formattedValue: any;
+  let paramType: string;
+  if (Array.isArray(binaryFilter.value)) {
+    formattedValue = binaryFilter.value.map(v =>
+      formatValue(binaryFilter.field, v, fieldDef, type),
+    );
+    paramType = isEnumFilter(binaryFilter.field, type)
+      ? '[ProcessInstanceState!]'
+      : '[String!]';
+  } else {
+    formattedValue = formatValue(
+      binaryFilter.field,
+      binaryFilter.value,
+      fieldDef,
+      type,
+    );
+    paramType = 'String';
+  }
+
+  const clauseVariableName = `clauseVariable${nonSecureRandomAlphaNumeric()}`;
+  const clause = `${binaryFilter.field}: {${getGraphQLOperator(binaryFilter.operator)}: $${clauseVariableName}}`;
+  const filterClauseVariable: FilterClauseVariable = {

Evidence

In handleBinaryOperator, the array branch uses `isEnumFilter(...) ? '[ProcessInstanceState!]' :
'[String!]', but the scalar branch hard-codes paramType = 'String'` with no enum check.
buildGraphQlQuery then renders variable definitions directly from clauseVariableType, so a
scalar state filter will declare $clauseVariableX: String even though this codebase already treats
state as ProcessInstanceState for list filters.

workspaces/orchestrator/plugins/orchestrator-backend/src/helpers/filterBuilder.ts[183-229]
workspaces/orchestrator/plugins/orchestrator-backend/src/helpers/queryBuilder.ts[20-36]
workspaces/orchestrator/plugins/orchestrator-common/src/models.ts[19-26]

Agent prompt

The issue below was found during a code review. Follow the provided context and guidance below and implement a solution

### Issue description
Scalar enum filters for `state` are emitted with `clauseVariableType: 'String'`, while list enum filters use `[ProcessInstanceState!]`. Because `buildGraphQlQuery` uses `clauseVariableType` to render variable definitions, this can generate an incorrect variable type for `state` equality filters.

### Issue Context
- `state` is treated as an enum via `isEnumFilter()`.
- Array enum values already use `[ProcessInstanceState!]`, implying the intended GraphQL variable type is `ProcessInstanceState`.

### Fix Focus Areas
- workspaces/orchestrator/plugins/orchestrator-backend/src/helpers/filterBuilder.ts[183-229]
- workspaces/orchestrator/plugins/orchestrator-backend/src/helpers/queryBuilder.ts[20-36]

### Suggested fix
- In the non-array branch of `handleBinaryOperator`, set `paramType` based on `isEnumFilter(binaryFilter.field, type)` (e.g., `ProcessInstanceState` for `state`, otherwise `String`).
- Add/extend a unit test to assert the emitted `clauseVariableType` for scalar `state` filters is `ProcessInstanceState` (not just the clause/value).

ⓘ Copy this prompt and use it to remediate the issue with your preferred AI generation tools

---

ⓘ The new review experience is currently in Beta. Learn more

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud