Enforce read-only Hive queries at the Bolt transaction level; map DB write rejection to 403 - #1611
Merged
Evanfeenstra merged 3 commits intoAug 28, 2026
Conversation
…write rejection to 403 GraphOps::execute_raw_cypher now runs through neo4rs execute_read() (Bolt autocommit mode "r"), so Neo4j itself refuses any write — including write procedures invoked via CALL, which the keyword denylist cannot generally catch. Database-level rejections (Neo.ClientError.Statement.AccessMode, or ProcedureCallFailed wrapping an access-mode violation) surface as shared::Error::ReadOnlyViolation and map to HTTP 403 in the Hive handler with the same body as the denylist rejection; warn! logs carry the Neo4j error code and query length (never the query body) at both boundaries. The denylist, forced LIMIT, and 4096-char cap stay as defense-in-depth, and the previously false 'read-mode transaction' comments now describe the real implementation. A test-only hive_query_handler_denylist_bypassed entry point (not wired into the router) lets the integration test prove the guarantee comes from the database: with the denylist disabled, CREATE and CALL apoc.create.node probes both return 403 and leave no trace in the graph, while MATCH and read-only procedures keep working (200). Verified against live Neo4j 5.19.
…bolt-transaction-403-1787916267
…bolt-transaction-403-1787916267
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
3 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
graph_opsshared/src/error.rsstandalone/tests/hive_read_only.rsGenerated with Hive