graphql-dotnet

Table of Contents

• About
• Security Considerations
• Request Validations
• Notable Vulnerabilities
• Security Disclosure

About

Language: C#
Source: https://github.com/graphql-dotnet/graphql-dotnet
Documentation: https://graphql-dotnet.github.io/docs/getting-started/introduction/

Security Considerations

graphql-dotnet provides the following features which should be taken into consideration:

Field Suggestions	Query Depth Limit	Query Cost Analysis	Automatic Persisted Queries	Introspection	Debug Mode	Batch Requests
✅ Enabled by Default	⚠️ Disabled by Default	⚠️ Disabled by Default	❌ No Support	✅ Enabled by Default	❌ No Support	⚠️ Disabled by Default

Request Validations

Total Validation Count: 29

GraphQL.NET validates the following checks when a query is sent:

Document Validations	Operation Validations	Field Validations	Argument Validations	Fragment Validations	Value Validations	Directive Validations	Variable Validations	Misc. Validations
	Lone Anonymous Operation	Fields On Correct Type	Arguments Of Correct Type	Fragments On Composite Types	Default Values Of Correct Type	Known Directives In Allowed Locations	Unique Variable Names	Input Fields And Arguments Of Correct Length
	Unique Operation Names	Overlapping Fields Can Be Merged	Known Argument Names	Known Fragment Names	Known Type Names	Unique Directives Per Location	Variables Are Input Types	No Introspection Validation Rule
		Scalar Leafs	Provided Non Null Arguments	No Fragment Cycles			No Undefined Variables	Complexity Validation Rule
		Single Root Field Subscriptions	Unique Argument Names	No Unused Fragments			No Unused Variable
		Unique Input Field Names		Possible Fragment Spreads			Variables In Allowed Position
				Unique Fragment Names

Security Disclosure

https://github.com/graphql-dotnet/graphql-dotnet/issues