graphql

GraphQL Detection

Overview

GraphQL inverts the usual API contract: the client, not the server, decides the exact shape of the data it receives, and a single endpoint accepts queries, mutations, and subscriptions written against a strongly typed schema. The weaknesses that follow are not one bug class but a set of ways that design amplifies familiar failures — authorization checked at the transport layer never fires for a nested field, a throttle that counts HTTP requests counts nothing when one request carries a hundred aliased operations, and a self-describing schema hands an attacker the complete map of everything the server can do. The flaws sit in two places: the server construction where introspection, limits, and transport rules are configured, and the resolver bodies where objects are fetched from arguments. The attacker is any API client, often unauthenticated, who sends operations the developers never intended to expose. What they gain ranges from the schema itself through other users' records to a practical brute force against a throttled login. This skill finds these by locating the server configuration and every resolver that fetches by argument, checking each in parallel, and merging the results into <output_dir>/graphql-results.md.

What it is NOT

• Access control (/websec:access-control): that skill owns authorization decided at routes, middleware, and handlers. A resolver that returns an object selected purely by a client-supplied argument, with no per-object check, is judged here — the missing check is a resolver-code shape found while reading the schema, and it is this class's highest-value finding. Discriminating test: if the fix belongs inside a resolver or a schema directive, it is here; if it belongs in HTTP middleware or a route guard covering the whole endpoint, note it for /websec:access-control.
• CSRF (/websec:csrf): a cookie-authenticated endpoint that executes mutations from a cross-site form is CSRF. Judge the GraphQL-specific transport posture here — whether GET and form-encoded bodies reach the executor and whether the declared content type is validated — and cross-reference /websec:csrf for the token and same-site question.
• Injection (/websec:sql-injection, /websec:nosql-injection, /websec:os-command-injection): GraphQL is a typed layer and injects nothing by itself. A resolver that concatenates an argument into an underlying query or command is owned by the matching injection skill; note the resolver here and classify there.
• Business logic (/websec:business-logic): alias multiplication or batching that defeats a coupon, attempt, or quota limit is judged here as a missing operation limit; the rule that limit was protecting belongs there. Discriminating test: which artefact does the fix change — the schema, a resolver, or the executor's operation limits (here), or a domain rule that would be equally wrong behind a REST route (there)?
• WebSockets (/websec:websockets): subscription transport, per-message authorization, and origin checks on the upgrade belong there. Note the subscription surface here and hand it over.
• Information disclosure (/websec:information-disclosure): a schema dump is disclosure. It is a finding here when introspection or suggestion output names types, fields, or arguments whose resolvers enforce an authorization check — that is, when the schema describes strictly more than the caller reading it can execute.
• API surface issues (/websec:api): a mutation input object that binds fields the caller should not be able to set, or a type that returns more properties than the caller should see, is the same defect that skill owns at REST endpoints. Test: if the fix is to narrow the input type or the selectable fields — the binding set — hand it there; if the fix is a per-object check inside the resolver, it stays here.
• Not a finding: __typename answering — that is defined behaviour on every server; introspection enabled on a schema whose every type and field already resolves without an authorization check; a field-level error with no schema-name suggestions; an unknown-field error on an otherwise authorized query.