zakirkun GraphQL Field-Level Injection
Overview
GraphQL resolvers that pass field arguments directly to database queries, OS commands, or other dangerous functions are vulnerable to injection. Unlike REST, GraphQL injection can be harder to detect because:
- Arguments arrive as parsed JavaScript objects (not raw strings)
- Multiple injection points per query
- Batch operations multiply impact
Remediation
- Use parameterized queries in all database operations within resolvers
- Validate and sanitize all resolver arguments
- Use schema-level validation with type coercion