Security Test: Cyclic query¶

Description¶

Default Severity: low

GraphQL lets you nest objects, but if not carefully controlled, malicious users can craft queries that go extremely deep, almost like a runaway loop. This can overwhelm your server, using up memory or processing power until it can't handle any more requests, effectively causing a denial of service. The risk comes from not setting limits on how deeply these queries can be nested, which is a common oversight that can leave your service vulnerable to attacks.

Reference:

• https://www.apollographql.com/blog/graphql/security/securing-your-graphql-api-from-malicious-queries/

Configuration¶

Identifier: resource_limitation/cyclic_query

Examples¶

All configuration available:

checks:
  resource_limitation/cyclic_query:
    skip: false # default
    options:
      skip_objects: # cf. Options below

Options¶

Options can be set in the options key of the Security Test Configuration.

Compliance and Standards¶