Unauthenticated RCE in Taskcluster web-server via GraphQL filter argument (sift $where)

The public GraphQL endpoint at `/graphql` allows an unauthenticated caller to execute arbitrary JavaScript inside the web-server's Node.js process. The query argument `filter` is a free-form JSON object that the server passes directly into the `sift` library. The version in use (`sift` 17.1.3) …

import sift from 'sift';
export default (filter, array) => {
  if (!array) return [];
  return filter ? array.filter(sift(filter)) : array;
};