A4J - inefficient usage of the Insight APIs resulting in WAF triggering

XMLWordPrintable

    • 0

      Issue Summary

      This is reproducible on Data Center: yes

      A4J allows to set up an action to update issue, and set an Insight CF with a value.

      When configuring an automation rule, to update an Insight cf, when typing a search string to llok for possible objects, A4J will trigger multiple http requests, across ALL object types, and searching for objects by Name ...

      This is very inefficient, and also triggers the Web Application Firewall due to the number of calls, in a large Insight instance.

      A4J will query in each Insight Object Type separately, even these that cannot be populating the cf for example - an object type NOT within the Schema the CF context is assigned to.

      The IQL API is only searching for objects by Name... but what if an object does not have a Name Attribute? If ever, the IQL should search "Label".

      It will be best though, if the Object search can search within all the CF Context configuration IQL and not globally.

      Steps to Reproduce

      1. Make sure you have a few object types, and possibly in a few object schemas
      2. Configure an Insight CF and add it to an Issue screen
      3. Use configuration like: Object Schema: Schame A, Filter Scope IQL: objectType=OTA
      4. Create a Global/Project Automation to edit an issue.
      5. In the automation rule, select the Insight CF to be updated, and open the Developer Tools console
      6. start typing "12" in the value search box

      Expected Results

      A dropdown of filtered objects, available to be selected in the CF - in accordance with the CF configuration.

      A4J will make the minimum required requests to get the available values.

      e.g. 'Label LIKE "<searchString>" '

      Actual Results

      We already have JIRAAUTOSERVER-482 - Automation for Jira when using an Insight CF disregards the Insight IQL configuration.

      In addition, the HAR file will show many (e.g. hundreds) IQL requests on the different object types, which may trigger the WAF:

      ...
       
      Fetchobjects?iql=objectTypeId=430%20and%20Name%20like%2012    
      Fetchobjects?iql=objectTypeId=412%20and%20Name%20like%2012    
      Fetchobjects?iql=objectTypeId=444%20and%20Name%20like%2012    
      Fetchobjects?iql=objectTypeId=460%20and%20Name%20like%2012    
      Fetchobjects?iql=objectTypeId=435%20and%20Name%20like%2012    
      Fetchobjects?iql=objectTypeId=424%20and%20Name%20like%2012    
      Fetchobjects?iql=objectTypeId=466%20and%20Name%20like%2012    
      Fetchobjects?iql=objectTypeId=413%20and%20Name%20like%2012    
      Fetchobjects?iql=objectTypeId=425%20and%20Name%20like%2012    
      Fetchobjects?iql=objectTypeId=448%20and%20Name%20like%2012    
      Fetchobjects?iql=objectTypeId=436%20and%20Name%20like%2012    
      Fetchobjects?iql=objectTypeId=426%20and%20Name%20like%2012    
      Fetchobjects?iql=objectTypeId=450%20and%20Name%20like%2012    
      Fetchobjects?iql=objectTypeId=414%20and%20Name%20like%2012    
      Fetchobjects?iql=objectTypeId=452%20and%20Name%20like%2012    
      Fetchobjects?iql=objectTypeId=415%20and%20Name%20like%2012    
      Fetchobjects?iql=objectTypeId=416%20and%20Name%20like%2012    
      Fetchobjects?iql=objectTypeId=417%20and%20Name%20like%2012    
      Fetchobjects?iql=objectTypeId=418%20and%20Name%20like%2012    
      Fetchobjects?iql=objectTypeId=419%20and%20Name%20like%2012    
      Fetchobjects?iql=objectTypeId=420%20and%20Name%20like%2012    
      619 / 746 requests
      759 kB / 1.2 MB transferred
      4.0 MB / 4.3 MB resources 

      Workaround

      Currently there is no known workaround for this behavior. A workaround will be added here when available.

      The functionality is hard-coded within A4J

            Assignee:
            Tomasz Pacuszka (Inactive)
            Reporter:
            Yinon Negev
            Votes:
            4 Vote for this issue
            Watchers:
            2 Start watching this issue

              Created:
              Updated: