sc-graphql

SC: GraphQL Security

Purpose

Detects GraphQL-specific security vulnerabilities including query injection, introspection information disclosure, batching abuse, nested query denial-of-service, field-level authorization bypass, and subscription hijacking. Covers Apollo Server, graphql-yoga, Strawberry, Graphene, gqlgen, and HotChocolate.

Activation

Called by sc-orchestrator during Phase 2 when GraphQL schema files, resolvers, or GraphQL dependencies are detected.

Phase 1: Discovery

File Patterns to Search

**/*.graphql, **/*.gql, **/schema.*, **/typeDefs.*, **/resolvers.*,
**/*resolver*, **/*schema*, **/*graphql*, **/mutations/*, **/queries/*,
**/subscriptions/*, **/directives/*

Keyword Patterns to Search

"typeDefs", "resolvers", "ApolloServer", "graphql-yoga", "makeExecutableSchema",
"buildSchema", "@Query", "@Mutation", "@Resolver", "GraphQLObjectType",
"introspection", "depthLimit", "costAnalysis", "complexityLimit",
"__schema", "__type", "subscription", "directive"

Security Checks

1. Introspection Enabled in Production

• Check if introspection is explicitly disabled in production config
• Search for: introspection: true, missing introspection config, NODE_ENV checks

2. Query Depth/Complexity Limits Missing

• Check for depth limiting middleware: graphql-depth-limit, depthLimit, @complexity
• Check for query cost analysis: graphql-query-complexity, costAnalysis
• Absence of both = vulnerable to nested query DoS

3. Batching Without Limits

• Check if query batching is enabled without limits
• Search for: allowBatchedHttpRequests, batch query handler, array query acceptance

4. Field-Level Authorization

• Check if resolver functions verify user permissions
• Search for missing auth checks in mutation resolvers
• Check directive-based auth: @auth, @hasRole, @authenticated

5. SQL/NoSQL Injection in Resolvers

• Trace GraphQL arguments through resolver to database queries
• Check if arguments are used in raw queries without parameterization