Meta Stack Exchange is where users like you discuss bugs, features, and support issues that affect the software powering all 157 Stack Exchange communities.

What is meta?
Here's how it works:
  1. Any Stack Exchange user can ask a question
  2. The community provides support, votes on ideas, and reports bugs
  3. Your voice helps shape the way Stack Exchange operates

I have seen the page for composing Data Explorer queries. If I enter some stupid queries like:

select * from Posts a, Posts b,  Posts c ..... where 1=1

etc., how does StackExchange prevent it from running? I have seen that limit is used. But will that be good enough?

When I did a two join, Chrome crashed after some time as the query took a long time as the loop call goes on...

share|improve this question
+1 Though I think the question should (also) be "How does DataExplorer protect against stupid SQL queries?" (like I've done myself, sadly). – NickC Apr 15 '11 at 21:03
in a way, it can be possibly used for DOS attacks? eg: compose 100 similar queries and save it then trigger the calls – hGx Apr 15 '11 at 21:06
Yeah definitely - but I think the chance of being brought down by good intentions is higher, since SEDE is isolated from SO/SE and therefore there isn't much to gain from a DOS attack. – NickC Apr 15 '11 at 21:09
oh yeah, the data is bimonthly archival – hGx Apr 15 '11 at 21:13
When query takes too much time to execute, it's timeout. For the rest I think it assume everyone has common sense and there's captcha too for anonymous execution. – HoLyVieR Apr 15 '11 at 22:13
Also, it limits results to 50000. – John Apr 15 '11 at 22:51
You can find out for yourself considering that the source code is available for the Data Explorer. – uɐɯsO uɐɥʇɐN Apr 16 '11 at 6:49
cool! i didn't know about the source and will look into it – hGx Apr 16 '11 at 9:31
possible duplicate of How is the data explorer secured? – Chris Frederick Oct 17 '11 at 17:32
up vote 14 down vote accepted

Well there are a bunch of things we do

The SQL Server instance is isolated and runs on a machine dedicated to, only containing public data.

This means that if stuff goes horribly wrong, performance of the main sites will not be affected.

Anonymous have to fill captchas

We had an instance where somebody had the very bright idea of running the same query over and over using some sophisticated robot like a shell script with wget. This is not going to happen anymore.

Throttles throttles and more throttles

There is a limit to the number of queries we will execute per user, per hour

Everything is cached

Second time we see any query, the results will be cached, which helps cut down on db traffic

Queries time out after 120 seconds

If you mess up and run an expensive query it will timeout. As an exercise for the reader I am not against also throttling CPU time on a per-user basis. Have not had the need to do this yet.

Number of results we return is capped

We do not return "infinite" results to the browsers we cap them.

share|improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .