Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Support graphql resolver arguments as vulnerability source #3835

Merged
merged 13 commits into from Feb 15, 2024

Conversation

uurien
Copy link
Collaborator

@uurien uurien commented Nov 30, 2023

What does this PR do?

Adds support for Graphql resolver arguments to detect injection vulnerabilities.

Motivation

Improve our injection vulnerabilities detection.

Checklist

  • Unit tests.

Additional Notes

Security

Datadog employees:

  • If this PR touches code that signs or publishes builds or packages, or handles credentials of any kind, I've requested a review from @DataDog/security-design-and-guidance.
  • This PR doesn't touch any of that.

Unsure? Have a question? Request a review!

APPSEC-12046

Copy link

github-actions bot commented Nov 30, 2023

Overall package size

Self size: 6.04 MB
Deduped: 61.64 MB
No deduping: 62.4 MB

Dependency sizes

name version self size total size
@datadog/native-iast-taint-tracking 1.6.4 16.43 MB 16.44 MB
@datadog/native-appsec 7.0.0 14.51 MB 14.52 MB
@datadog/pprof 5.0.0 9.59 MB 10.44 MB
protobufjs 7.2.5 2.77 MB 6.56 MB
@datadog/native-iast-rewriter 2.2.3 2.19 MB 2.28 MB
@opentelemetry/core 1.14.0 872.87 kB 1.47 MB
@datadog/native-metrics 2.0.0 898.77 kB 1.3 MB
@opentelemetry/api 1.4.1 780.32 kB 780.32 kB
import-in-the-middle 1.7.3 67.62 kB 731.01 kB
pprof-format 2.0.7 588.12 kB 588.12 kB
msgpack-lite 0.1.26 201.16 kB 281.59 kB
opentracing 0.14.7 194.81 kB 194.81 kB
semver 7.5.4 93.4 kB 123.8 kB
@datadog/sketches-js 2.1.0 109.9 kB 109.9 kB
lodash.sortby 4.7.0 75.76 kB 75.76 kB
lru-cache 7.14.0 74.95 kB 74.95 kB
ipaddr.js 2.1.0 60.23 kB 60.23 kB
ignore 5.2.4 51.22 kB 51.22 kB
int64-buffer 0.1.10 49.18 kB 49.18 kB
shell-quote 1.8.1 44.96 kB 44.96 kB
istanbul-lib-coverage 3.2.0 29.34 kB 29.34 kB
tlhunter-sorted-set 0.1.0 24.94 kB 24.94 kB
limiter 1.1.5 23.17 kB 23.17 kB
dc-polyfill 0.1.4 23.1 kB 23.1 kB
retry 0.13.1 18.85 kB 18.85 kB
node-abort-controller 3.1.1 16.89 kB 16.89 kB
jest-docblock 29.7.0 8.99 kB 12.76 kB
crypto-randomuuid 1.0.0 11.18 kB 11.18 kB
path-to-regexp 0.1.7 6.78 kB 6.78 kB
koalas 1.0.2 6.47 kB 6.47 kB
methods 1.1.2 5.29 kB 5.29 kB
module-details-from-path 1.0.3 4.47 kB 4.47 kB

🤖 This report was automatically generated by heaviest-objects-in-the-universe

Copy link

codecov bot commented Nov 30, 2023

Codecov Report

All modified and coverable lines are covered by tests ✅

Comparison is base (853223d) 85.33% compared to head (3c3510d) 85.34%.

Additional details and impacted files
@@           Coverage Diff           @@
##           master    #3835   +/-   ##
=======================================
  Coverage   85.33%   85.34%           
=======================================
  Files         243      243           
  Lines       10570    10576    +6     
  Branches       33       33           
=======================================
+ Hits         9020     9026    +6     
  Misses       1550     1550           

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

@pr-commenter
Copy link

pr-commenter bot commented Nov 30, 2023

Benchmarks

Benchmark execution time: 2024-02-15 08:39:48

Comparing candidate commit 3c3510d in PR branch ugaitz/graphql-sources-iast with baseline commit 853223d in branch master.

Found 0 performance improvements and 0 performance regressions! Performance is the same for 258 metrics, 8 unstable metrics.

@uurien uurien force-pushed the ugaitz/graphql-sources-iast branch 2 times, most recently from 53e6b19 to 8e10b69 Compare February 12, 2024 11:28
@uurien uurien marked this pull request as ready for review February 12, 2024 11:28
@uurien uurien requested review from a team as code owners February 12, 2024 11:28
@uurien uurien marked this pull request as draft February 12, 2024 16:09
Qard
Qard previously approved these changes Feb 13, 2024
…in.apollo-server-express.plugin.spec.js

Co-authored-by: Carles Capell <107924659+CarlesDD@users.noreply.github.com>
@uurien uurien merged commit 6aa4ab2 into master Feb 15, 2024
110 of 111 checks passed
@uurien uurien deleted the ugaitz/graphql-sources-iast branch February 15, 2024 09:08
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Projects
None yet
Development

Successfully merging this pull request may close these issues.

None yet

3 participants