fix(security): disable reading query config

[char0n]

Refs #4872

My PR contains...

• No code changes (src/ is unmodified: changes to documentation, CI, metadata, etc.)
• Dependency changes (any modification to dependencies in package.json)
• Bug fixes (non-breaking change which fixes an issue)
• Improvements (misc. changes to existing features)
• Features (non-breaking change which adds functionality)

My changes...

• are breaking changes to a public API (config options, System API, major UI change, etc).
• are breaking changes to a private API (Redux, component props, utility functions, etc.).
• are breaking changes to a developer API (npm script behavior changes, new dev system dependencies, etc).
• are not breaking changes.

Documentation

• My changes do not require a change to the project documentation.
• My changes require a change to the project documentation.
• If yes to above: I have updated the documentation accordingly.

Automated tests

• My changes can not or do not need to be tested.
• My changes can and should be tested by unit and/or integration tests.
• If yes to above: I have added tests to cover my changes.
• If yes to above: I have taken care to cover edge cases in my tests.
• All new and existing tests passed.

[ghilainm]

This is actually a breaking change.

[char0n]

@ghilainm without the further context we can say that is a breaking change . But this PR was done in security context - we were fixing an obvious security issue, which shouldn't be there in the first place. By fixing the security issue we changed the behavior of the software in non-compatible way, but we've also provided a way how to achieve the original behavior if one is willing to accept the security implications.

Active security advisory: GHSA-qrmm-w75w-3wpx

[ghilainm]

I though I removed that comment I agree with you.

Sorry for troubles