Security Test: Typing misconfiguration¶

Description¶

Default Severity: medium

A typing misconfiguration happens when a system accepts a parameter in a form that's not expected—like receiving a number when it should be a string—and it ends up processing it anyway. This can be dangerous because the application might mishandle or misinterpret the data, potentially letting attackers inject unexpected values or exploit logic errors. Often, developers assume that the input will always match the expected type and don't include strict type checking, which can leave the door open for misuse. If left unchecked, these issues can cause unintended behavior, compromise data integrity, or even open paths for more serious attacks.

Reference:

• https://cheatsheetseries.owasp.org/cheatsheets/GraphQL_Cheat_Sheet.html

Configuration¶

Identifier: schema/typing_misconfiguration

Examples¶

All configuration available:

checks:
  schema/typing_misconfiguration:
    skip: false # default
    options:
      skip_objects: # cf. Options below

Options¶

Options can be set in the options key of the Security Test Configuration.

Compliance and Standards¶