mirror of
https://github.com/fabriziosalmi/caddy-waf.git
synced 2026-08-01 07:16:14 -04:00
65 lines
2.0 KiB
JSON
65 lines
2.0 KiB
JSON
[
|
|
{
|
|
"id": "graphql-introspection-query",
|
|
"phase": 2,
|
|
"pattern": "(?i)(?:query\\s+__schema|mutation\\s+__schema|fragment\\s+__schema|\\{\\s*__schema)",
|
|
"targets": ["BODY"],
|
|
"severity": "MEDIUM",
|
|
"action": "log",
|
|
"score": 5,
|
|
"description": "Log GraphQL queries attempting to access the schema."
|
|
},
|
|
{
|
|
"id": "graphql-union-type-abuse",
|
|
"phase": 2,
|
|
"pattern": "(?i)(?:...\\s+on\\s+)",
|
|
"targets": ["BODY"],
|
|
"severity": "MEDIUM",
|
|
"action": "log",
|
|
"score": 5,
|
|
"description": "Log usage of union types that can be used for denial of service."
|
|
},
|
|
{
|
|
"id": "graphql-directives-abuse",
|
|
"phase": 2,
|
|
"pattern": "(?i)@skip|@include",
|
|
"targets": ["BODY"],
|
|
"severity": "MEDIUM",
|
|
"action": "log",
|
|
"score": 4,
|
|
"description": "Log GraphQL queries using directives (skip, include) that can be abused."
|
|
},
|
|
{
|
|
"id":"graphql-field-alias-abuse",
|
|
"phase": 2,
|
|
"pattern": "(?i)(\\w+):\\s*\\w+\\s*\\(",
|
|
"targets": ["BODY"],
|
|
"severity": "LOW",
|
|
"action":"log",
|
|
"score": 3,
|
|
"description":"Log GraphQL queries using field aliases that can be abused"
|
|
|
|
},
|
|
{
|
|
"id": "graphql-batching",
|
|
"phase": 2,
|
|
"pattern":"(?i)(?:\\{(?:\\s*(?:query|mutation|fragment)\\s*\\w*\\s*\\{.*?\\})\\s*\\}\\s*){2,}",
|
|
"targets":["BODY"],
|
|
"severity": "MEDIUM",
|
|
"action": "log",
|
|
"score": 4,
|
|
"description": "Log GraphQL batching attempts that might be used for resource exhaustion."
|
|
},
|
|
{
|
|
"id":"graphql-inline-fragments",
|
|
"phase":2,
|
|
"pattern":"(?i)(?:\\.\\.\\.\\s*\\{\\s*(?:\\w+\\s*\\{.*?\\})\\s*\\})",
|
|
"targets": ["BODY"],
|
|
"severity":"MEDIUM",
|
|
"action":"log",
|
|
"score": 4,
|
|
"description":"Log GraphQL queries using inline fragments, that might be used for DoS"
|
|
|
|
}
|
|
]
|