Security Test: High number of Custom Scalars¶
Scanner(s) Support¶
| GraphQL Scanner | REST Scanner | Frontend Scanner |
|---|---|---|
Description¶
Default Severity:
A response contains more than defined threshold of custom scalars with a sensitivity greater than MEDIUM.
Configuration¶
Identifier:
sensitive_data/high_number_of_custom_scalars
Examples¶
All configuration available:
checks:
sensitive_data/high_number_of_custom_scalars:
skip: false # default
options:
detection_threshold: 4 # default
Combine with Custom Scalar
scalars:
customer-id:
description: One user should not see too much customer IDs in one single API request
examples:
- xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx
names:
- customer_id
- x-customer-id
sensitivity: HIGH
strategy: key
security_tests:
high_number_of_custom_scalars:
detection_threshold: 10
Options¶
Options can be set in the options key of the Security Test Configuration.
| Property | Type | Default | Description |
|---|---|---|---|
detection_threshold | number | 4 |
Compliance and Standards¶
| Standard | Value |
|---|---|
| OWASP API Top 10 | API7:2023 |
| OWASP LLM Top 10 | LLM06:2023 |
| PCI DSS | 6.5.3 |
| GDPR | Article-32 |
| SOC2 | CC6 |
| PSD2 | Article-95 |
| ISO 27001 | A.9.4 |
| NIST | SP800-53 |
| FedRAMP | SC-12 |
| CWE | 200 |
| CVSS Vector | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N/E:H/RL:O/RC:C |
| CVSS Score | 8.2 |