owasp-modsecurity / owasp-modsecurity/ModSecurity
NEW FEATURE: GraphQL Security
Nobody has claimed this yet.
- Dominant language
- C++
- Stars
- 9.8k
- Forks
- 1.8k
- Avg merge
- 2h 46m
- Merged PRs (30d)
- 1
Description
ModSecurity should include a new feature to parse graphQL queries. Nowadays, many big companies are using graphQL. It involves complex configurations that may expose the applications to various security vulnerabilities, such as, DoS Attacks, Injection Attacks, Introspection Queries (which can expose sensitive data), or other malicious queries.
ModSecurity should provide native parsing of GraphQL requests and enforces security checks to protect against these attacks.
Contributor guide
No contributing guide indexed for this repository
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Start by reviewing ModSecurity's request-processing architecture and existing security checks; the issue names no files or tests. Define the scope for native GraphQL request parsing and the checks needed for DoS, injection, and introspection risks, then validate that protected GraphQL requests are handled by the engine.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- cpp, graphql
- Domain
- backend-api-design, security
- Issue type
- Feature
- Difficulty
- 5/5
- Estimated time
- Over a week
- Activity status
- Stale
- Clarity
- Needs clarification
- Newbie friendliness
- 25/100