Empty query filter causing terrible query

[mlissner]

I have a database with hundreds of millions of items that I let the public query via a fairly open API. One of our API users wrote some buggy software that sends us a filter parameter with no value:

&docket__id=

I.e., they're setting up a filter, but then not putting a danged value into it.

Doing the filter above relies on a RelatedFilter from the django-rest-framework-filters package, but I'm raising it here because I wonder if it's not a bug that DRF lets such query parameters through to the underlying filter classes in the first place. Should DRF remove errant parameters like this as early as possible given that it's not a parameter-value pair?

---

When the above runs, it does the following query, which takes about ten minutes:

SELECT COUNT(*) AS "__count" FROM "search_docketentry" WHERE "search_docketentry"."docket_id" IN (SELECT U0."id" FROM "search_docket" U0);

(The subquery has about 60M rows, and the table in the main query has about 200M...what could go wrong?)

[tomchristie]

Should DRF remove errant parameters like this as early as possible given that it's not a parameter-value pair?

Not sure without looking into it further but does look like a good candidate to prioritise.