graphql-ruby

Table of Contents

• About
• Security Considerations
• Request Validations
• Notable Vulnerabilities
• Security Disclosure

About

Language: Ruby
Source: https://github.com/rmosolgo/graphql-ruby
Documentation: https://graphql-ruby.org/

Security Considerations

graphql-ruby provides the following features which should be taken into consideration:

Field Suggestions	Query Depth Limit	Query Cost Analysis	Automatic Persisted Queries	Introspection	Debug Mode	Batch Requests
✅ Enabled by Default	❌ No Support	⚠️ Disabled by Default	⚠️ Disabled by Default	✅ Enabled by Default	❌ No Support	✅ Enabled by Default

Request Validations

Total Validation Count: 28

GraphQL Ruby validates the following checks when a query is sent:

Document Validations	Operation Validations	Field Validations	Argument Validations	Fragment Validations	Value Validations	Directive Validations	Variable Validations	Misc. Validations
	Mutation root exists	Fields are defined on type	Argument literals are compatible	Fragment names are unique	Input object names are unique	Directives are defined	Variables default values are correctly typed	No definitions are present
	Operation names are valid	Fields have appropriate selections	Argument names are unique	Fragment spreads are possible	Required input object attributes are present	Directives are in valid locations	Variable names are unique
	Query root exists	Field will merge	Arguments are defined	Fragment types exist		Unique directives per location	Variable usages are allowed
	Subscription root exists		Requried arguments are present	Fragements are finite			Variables are input types
				Fragments are named			Variables are used and defined
				Fragments are on composite types

Security Disclosure

https://github.com/rmosolgo/graphql-ruby/issues