rules-graphql

Potentially unsafe pattern detected in graphql code: "resolve(". Review the use case — this may indicate a security risk, a deprecated API, or a misconfiguration. Confirm the write is intentional.

You are using an outdated API for graphql. Please upgrade to the newer API.

RISK: Unlimited query batching allows an attacker to send thousands of operations in a single HTTP request, multiplying server load and enabling credential-stuffing-style enumeration against resolvers. FIX: Set allowBatchedHttpRequests: false or add a batchLimit; implement rate limiting at the connection level.

RISK: Apollo Server's default 'Did you mean X?' field suggestions leak partial schema information even when introspection is disabled — attackers use suggestion leakage to enumerate field names one character at a time. FIX: Set hideSchemaDetailsFromClientErrors: true in ApolloServer options or disable field suggestions via @escape-technologies/graphql-armor.

RISK: Enabling GraphQL introspection in production exposes the full schema to attackers — field names, types, and relationships — accelerating reconnaissance before targeted injection or IDOR attacks. FIX: Disable introspection in production (NODE_ENV === 'production' guard or dedicated config flag); use tools like GraphQL Armor or Apollo Studio for schema exploration in dev.

RISK: GraphQL without query depth limits is vulnerable to deeply nested query DoS attacks — a single query like { user { friends { friends { friends ... } } } } can exhaust CPU/memory with O(n^k) resolver calls. FIX: Add graphql-depth-limit or @escape-technologies/graphql-armor's maxDepth plugin; enforce a depth of 7-10 for typical APIs.

RISK: Enabling GraphQL Playground or GraphiQL in production exposes an interactive query editor to any visitor, allowing exploration of the full schema and direct execution of any authorized query. FIX: Guard playground/graphiql with a NODE_ENV !== 'production' check; disable entirely in prod.

RISK: String-concatenating GraphQL resolver arguments into SQL queries is SQL injection — attackers pass ' OR '1'='1 as any argument to dump the database (CWE-89). FIX: Use parameterised queries (prepared statements, ORM query builders) and never concatenate user-supplied resolver args into SQL strings.

RISK: GraphQL mutations without authentication checks allow unauthenticated callers to modify data — a common misconfiguration that exposes create/update/delete operations to the public internet (CWE-306). FIX: Add auth middleware (isAuthenticated directive, shield, or context.user guard) to every mutation resolver; default-deny with explicit opt-out for public operations.