Security Test: Cyclic Recursive Query¶

Description¶

Default Severity: info

When an attacker sends a query that causes objects to reference each other in a loop, it can make the returned data grow exponentially. Essentially, the vulnerability arises when your system doesn't properly manage these circular calls, so each repeated reference adds more data until it overwhelms your server's capacity. This can lead to a Denial of Service, making your system slow or completely unavailable. Many developers fall into the trap of assuming that the query size will automatically be capped or that such recursive scenarios won’t occur, leaving the system exposed if those safeguards aren’t explicitly set up.

Configuration¶

Identifier: resource_limitation/graphql_circular_introspection

Examples¶

All configuration available:

checks:
  resource_limitation/graphql_circular_introspection:
    skip: false # default

Compliance and Standards¶