graphql-java

Table of Contents

• About
• Security Considerations
• Request Validations
• Notable Vulnerabilities
• Security Disclosure

About

Language: java
Source: https://github.com/graphql-java/graphql-java
Documentation: https://www.graphql-java.com/

Security Considerations

graphql-java provides the following features which should be taken into consideration:

Field Suggestions	Query Depth Limit	Query Cost Analysis	Automatic Persisted Queries	Introspection	Debug Mode	Batch Requests
✅ Enabled by Default	⚠️ Disabled by Default	⚠️ Disabled by Default	❌ No Support	✅ Enabled by Default	❌ No Support	⚠️ Disabled by Default

Request Validations

Total Validation Count: 26

Document Validations	Operation Validations	Field Validations	Argument Validations	Fragment Validations	Value Validations	Directive Validations	Variable Validations	Misc. Validations
Executable Definitions	Lone Anonymous Operation	Fields On Correct Type	Arguments Of Correct Type	Fragments On Composite Type	Known Type Names	Known Directives	No Undefined Variables
	Unique Operation Names	Overlapping Fields Can Be Merged	Known Argument Names	Provided Non Null Arguments	Known Fragment Names		No Unused Variables
		Scalar Leafs	Unique Argument Names Rule	No Fragment Cycles	No Unused Fragments
			Unique Directive Names Per Location	Possible Fragment Spreads			Unique Variable Names Rule
				Unique Fragment Names			Variable Default Values Of Correct Type
							Variable Types Match Rule
							Variables Are Input Types
							Variables Types Matcher

Security Disclosure

https://github.com/graphql-java/graphql-java/issues