Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

GraphQL threats detection and protection #3769

Merged
merged 36 commits into from
Jul 24, 2024
Merged

GraphQL threats detection and protection #3769

Show file tree
Hide file tree
Changes from 33 commits
Commits
Show all changes
36 commits
Select commit Hold shift + click to select a range
551f932
Update docs
vpellan Jun 21, 2024
7266a20
Add GraphQL AppSec integration architecture (without reactive engine)
vpellan Jun 3, 2024
1cc1d9a
Add rbs files for GraphQL AppSec
vpellan Jun 3, 2024
e52d022
Add throw/catch to stop execution of query
vpellan Jun 3, 2024
3c64cf2
Add reactive_engine for GraphQL resolvers
vpellan Jun 5, 2024
0873678
Add graphql reactive engine sig
vpellan Jun 5, 2024
5708dfd
Fix undefined var in error_query
vpellan Jun 5, 2024
85a73e4
Fix typo for fetch_configuration
vpellan Jun 6, 2024
785d122
Add GraphQL custom JSON block response
vpellan Jun 6, 2024
10158e1
Added iterative tree traversal to get arguments on execute_multiplex
vpellan Jun 11, 2024
2028b55
Add graphql.server.all_resolvers blocking
vpellan Jun 12, 2024
b182075
Remove blocking on individual resolvers
vpellan Jun 12, 2024
336a0e8
Add reactive engine multiplex tests
vpellan Jun 13, 2024
b419dbe
Fixed typing
vpellan Jun 13, 2024
b9127c0
Factorize reactive engine specs
vpellan Jun 14, 2024
8fa09d0
Extracted multiplex creation in separate helper
vpellan Jun 14, 2024
04460fb
Add multiplex gateway tests
vpellan Jun 14, 2024
b222c21
Added userByName in test schema
vpellan Jun 17, 2024
372a99e
Added basic GraphQL query & multiplex tests
vpellan Jun 17, 2024
86bd19f
Added integration tests & rake task for ruby 3.2
vpellan Jun 19, 2024
f977319
Added GraphQL 2.3 appraisals & added Rails to GraphQL appraisals (for…
vpellan Jun 26, 2024
a28d284
Added more integration tests
vpellan Jun 26, 2024
e6c83da
Update jruby gemfiles
vpellan Jun 26, 2024
6fdd46a
Removed code that belongs to rack
vpellan Jun 28, 2024
4727301
Added more integration tests
vpellan Jul 1, 2024
246907e
Add custom JSON + fix blocking query test
vpellan Jul 1, 2024
58fcaa5
Added multiplex integration test
vpellan Jul 1, 2024
d6285df
Added mutation testing
vpellan Jul 5, 2024
6e274dc
Update libdatadog in ruby-3.3-graphql-2.3 gemfile
vpellan Jul 5, 2024
5aa2ed6
Add support for Ruby 3.4
vpellan Jul 8, 2024
4798b11
Fix appraisals gemfile.lock
vpellan Jul 8, 2024
16cf884
Add type signature
vpellan Jul 9, 2024
6ed85c9
Removed redundant comment
vpellan Jul 9, 2024
93ef101
remove ext file
vpellan Jul 11, 2024
5f4f191
moved dynamically loaded require to top level loaded
vpellan Jul 11, 2024
9295cad
Separate GraphQL response generation from blocking detection
vpellan Jul 16, 2024
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
8 changes: 8 additions & 0 deletions Matrixfile
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -73,6 +73,7 @@
'activesupport' => '✅ 2.5 / ✅ 2.6 / ✅ 2.7 / ✅ 3.0 / ✅ 3.1 / ✅ 3.2 / ✅ 3.3 / ✅ 3.4 / ✅ jruby'
},
'graphql' => {
'graphql-2.3' => '❌ 2.5 / ❌ 2.6 / ✅ 2.7 / ✅ 3.0 / ✅ 3.1 / ✅ 3.2 / ✅ 3.3 / ✅ 3.4 / ✅ jruby',
'graphql-2.2' => '❌ 2.5 / ❌ 2.6 / ✅ 2.7 / ✅ 3.0 / ✅ 3.1 / ✅ 3.2 / ✅ 3.3 / ✅ 3.4 / ✅ jruby',
'graphql-2.1' => '❌ 2.5 / ❌ 2.6 / ✅ 2.7 / ✅ 3.0 / ✅ 3.1 / ✅ 3.2 / ✅ 3.3 / ✅ 3.4 / ✅ jruby',
'graphql-2.0' => '✅ 2.5 / ✅ 2.6 / ✅ 2.7 / ✅ 3.0 / ✅ 3.1 / ✅ 3.2 / ✅ 3.3 / ✅ 3.4 / ✅ jruby',
Expand Down Expand Up @@ -258,6 +259,13 @@
'rails5-mysql2' => '✅ 2.5 / ✅ 2.6 / ✅ 2.7 / ❌ 3.0 / ❌ 3.1 / ❌ 3.2 / ❌ 3.3 / ❌ 3.4 / ❌ jruby',
'rails6-mysql2' => '✅ 2.5 / ✅ 2.6 / ✅ 2.7 / ❌ 3.0 / ❌ 3.1 / ❌ 3.2 / ❌ 3.3 / ❌ 3.4 / ❌ jruby',
'rails61-mysql2' => '✅ 2.5 / ✅ 2.6 / ✅ 2.7 / ✅ 3.0 / ✅ 3.1 / ✅ 3.2 / ✅ 3.3 / ✅ 3.4 / ❌ jruby'
},
'appsec:graphql' => {
'graphql-2.3' => '❌ 2.5 / ❌ 2.6 / ✅ 2.7 / ✅ 3.0 / ✅ 3.1 / ✅ 3.2 / ✅ 3.3 / ✅ 3.4 / ✅ jruby',
'graphql-2.2' => '❌ 2.5 / ❌ 2.6 / ✅ 2.7 / ✅ 3.0 / ✅ 3.1 / ✅ 3.2 / ✅ 3.3 / ✅ 3.4 / ✅ jruby',
'graphql-2.1' => '❌ 2.5 / ❌ 2.6 / ✅ 2.7 / ✅ 3.0 / ✅ 3.1 / ✅ 3.2 / ✅ 3.3 / ✅ 3.4 / ✅ jruby',
'graphql-2.0' => '✅ 2.5 / ✅ 2.6 / ✅ 2.7 / ✅ 3.0 / ✅ 3.1 / ✅ 3.2 / ✅ 3.3 / ✅ 3.4 / ✅ jruby',
'graphql-1.13' => '❌ 2.5 / ✅ 2.6 / ✅ 2.7 / ✅ 3.0 / ✅ 3.1 / ✅ 3.2 / ✅ 3.3 / ✅ 3.4 / ✅ jruby',
}
}.freeze
# rubocop:enable Layout/HashAlignment
Expand Down
3 changes: 2 additions & 1 deletion Rakefile
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -247,7 +247,7 @@ namespace :spec do
end

namespace :appsec do
task all: [:main, :rack, :rails, :sinatra, :devise]
task all: [:main, :rack, :rails, :sinatra, :devise, :graphql]

# Datadog AppSec main specs
desc '' # "Explicitly hiding from `rake -T`"
Expand All @@ -264,6 +264,7 @@ namespace :spec do
:sinatra,
:rails,
:devise,
:graphql,
].each do |contrib|
desc '' # "Explicitly hiding from `rake -T`"
RSpec::Core::RakeTask.new(contrib) do |t, args|
Expand Down
3 changes: 3 additions & 0 deletions appraisal/jruby-9.2.rb
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -246,7 +246,10 @@
'2.0',
].each do |v|
appraise "graphql-#{v}" do
gem 'rails', '~> 6.1.0'
gem 'graphql', "~> #{v}.0"
gem 'sprockets', '< 4'
gem 'lograge', '~> 0.11'
end
end

Expand Down
3 changes: 3 additions & 0 deletions appraisal/jruby-9.3.rb
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -219,7 +219,10 @@
'1.13',
].each do |v|
appraise "graphql-#{v}" do
gem 'rails', '~> 6.1.0'
gem 'graphql', "~> #{v}.0"
gem 'sprockets', '< 4'
gem 'lograge', '~> 0.11'
end
end

Expand Down
4 changes: 4 additions & 0 deletions appraisal/jruby-9.4.rb
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -118,13 +118,17 @@
end

[
'2.3',
'2.2',
'2.1',
'2.0',
'1.13',
].each do |v|
appraise "graphql-#{v}" do
gem 'rails', '~> 6.1.0'
gem 'graphql', "~> #{v}.0"
gem 'sprockets', '< 4'
gem 'lograge', '~> 0.11'
end
end

Expand Down
3 changes: 3 additions & 0 deletions appraisal/ruby-2.5.rb
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -266,7 +266,10 @@
'2.0',
].each do |v|
appraise "graphql-#{v}" do
gem 'rails', '~> 6.1.0'
gem 'graphql', "~> #{v}.0"
gem 'sprockets', '< 4'
gem 'lograge', '~> 0.11'
end
end

Expand Down
3 changes: 3 additions & 0 deletions appraisal/ruby-2.6.rb
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -220,7 +220,10 @@
'1.13',
].each do |v|
appraise "graphql-#{v}" do
gem 'rails', '~> 6.1.0'
gem 'graphql', "~> #{v}.0"
gem 'sprockets', '< 4'
gem 'lograge', '~> 0.11'
end
end

Expand Down
4 changes: 4 additions & 0 deletions appraisal/ruby-2.7.rb
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -215,13 +215,17 @@
end

[
'2.3',
'2.2',
'2.1',
'2.0',
'1.13',
].each do |v|
appraise "graphql-#{v}" do
gem 'rails', '~> 6.1.0'
gem 'graphql', "~> #{v}.0"
gem 'sprockets', '< 4'
gem 'lograge', '~> 0.11'
end
end

Expand Down
4 changes: 4 additions & 0 deletions appraisal/ruby-3.0.rb
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -129,13 +129,17 @@
end

[
'2.3',
'2.2',
'2.1',
'2.0',
'1.13',
].each do |v|
appraise "graphql-#{v}" do
gem 'rails', '~> 6.1.0'
gem 'graphql', "~> #{v}.0"
gem 'sprockets', '< 4'
gem 'lograge', '~> 0.11'
end
end

Expand Down
4 changes: 4 additions & 0 deletions appraisal/ruby-3.1.rb
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -129,13 +129,17 @@
end

[
'2.3',
'2.2',
'2.1',
'2.0',
'1.13',
].each do |v|
appraise "graphql-#{v}" do
gem 'rails', '~> 6.1.0'
gem 'graphql', "~> #{v}.0"
gem 'sprockets', '< 4'
gem 'lograge', '~> 0.11'
end
end

Expand Down
4 changes: 4 additions & 0 deletions appraisal/ruby-3.2.rb
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -129,13 +129,17 @@
end

[
'2.3',
'2.2',
'2.1',
'2.0',
'1.13',
].each do |v|
appraise "graphql-#{v}" do
gem 'rails', '~> 6.1.0'
gem 'graphql', "~> #{v}.0"
gem 'sprockets', '< 4'
gem 'lograge', '~> 0.11'
end
end

Expand Down
15 changes: 4 additions & 11 deletions appraisal/ruby-3.3.rb
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -129,24 +129,17 @@
end

[
'2.3',
'2.2',
'2.1',
'2.0',
'1.13',
].each do |v|
appraise "graphql-#{v}" do
gem 'rails', '~> 6.1.0'
gem 'graphql', "~> #{v}.0"
end
end

[
'2.2',
'2.1',
'2.0',
'1.13',
].each do |v|
appraise "graphql-#{v}" do
gem 'graphql', "~> #{v}.0"
gem 'sprockets', '< 4'
gem 'lograge', '~> 0.11'
end
end

Expand Down
16 changes: 5 additions & 11 deletions appraisal/ruby-3.4.rb
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -129,24 +129,18 @@
end

[
'2.3',
'2.2',
'2.1',
'2.0',
'1.13',
].each do |v|
appraise "graphql-#{v}" do
gem 'rails', '~> 6.1.0'
gem 'graphql', "~> #{v}.0"
end
end

[
'2.2',
'2.1',
'2.0',
'1.13',
].each do |v|
appraise "graphql-#{v}" do
gem 'graphql', "~> #{v}.0"
gem 'sprockets', '< 4'
gem 'lograge', '~> 0.11'
gem 'mutex_m', '>= 0.1.0'
end
end

Expand Down
14 changes: 7 additions & 7 deletions docs/GettingStarted.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -855,13 +855,13 @@ YourSchema.execute(query, variables: {}, context: {}, operation_name: nil)

The `instrument :graphql` method accepts the following parameters. Additional options can be substituted in for `options`:

| Key | Env Var | Type | Description | Default |
| ------------------------ | - | ------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------ | ---------------- |
| `enabled` | `DD_TRACE_GRAPHQL_ENABLED` | `Bool` | Whether the integration should create spans. | `true` |
| `schemas` | | `Array` | Array of `GraphQL::Schema` objects (that support class-based schema only) to trace. If you do not provide any, then tracing will applied to all the schemas. | `[]` |
| `with_unified_tracer` | | `Bool` | Enable to instrument with `UnifiedTrace` tracer, enabling support for API Catalog. `with_deprecated_tracer` has priority over this. Default is `false`, using `GraphQL::Tracing::DataDogTrace` (Added in v2.2) | `false` |
| `with_deprecated_tracer` | | `Bool` | Enable to instrument with deprecated `GraphQL::Tracing::DataDogTracing`. Default is `false`, using `GraphQL::Tracing::DataDogTrace` | `false` |
| `service_name` | | `String` | Service name used for graphql instrumentation | `'ruby-graphql'` |
| Key | Env Var | Type | Description | Default |
| ------------------------ | -------------------------- | -------- | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ---------------- |
| `enabled` | `DD_TRACE_GRAPHQL_ENABLED` | `Bool` | Whether the integration should create spans. | `true` |
| `schemas` | | `Array` | Array of `GraphQL::Schema` objects (that support class-based schema only) to trace. If you do not provide any, then tracing will applied to all the schemas. | `[]` |
| `with_unified_tracer` | | `Bool` | Enable to instrument with `UnifiedTrace` tracer, enabling support for API Catalog. `with_deprecated_tracer` has priority over this. Default is `false`, using `GraphQL::Tracing::DataDogTrace` (Added in v2.2) | `false` |
| `with_deprecated_tracer` | | `Bool` | Enable to instrument with deprecated `GraphQL::Tracing::DataDogTracing`. This has priority over `with_unified_tracer`. Default is `false`, using `GraphQL::Tracing::DataDogTrace` | `false` |
| `service_name` | | `String` | Service name used for graphql instrumentation | `'ruby-graphql'` |
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

'ruby-graphql'

The ruby- prefix seems odd. Shouldn't it simply be graphql? (Really I don't know)

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I agree but this has been added 6 years ago, maybe we should create a new PR about it ?


**Manually configuring GraphQL schemas**

Expand Down
3 changes: 3 additions & 0 deletions gemfiles/jruby_9.2_graphql_2.0.gemfile
View file
Open in desktop

Some generated files are not rendered by default. Learn more about how customized files appear on GitHub.

Loading
Loading