tartiflette.md

tartiflette

Table of Contents

• About
• Security Considerations
• Request Validations
• Notable Vulnerabilities
• Security Disclosure

About

Language: python
Source: https://github.com/tartiflette/tartiflette
Documentation: https://tartiflette.io/

Security Considerations

Tartiflette provides the following features which should be taken into consideration:

Field Suggestions	Query Depth Limit	Query Cost Analysis	Automatic Persisted Queries	Introspection	Debug Mode	Batch Requests
❌ No Support	❌ No Support	❌ No Support	❌ No Support	✅ Enabled by Default	❌ No Support	❌ No Support

Despite Tartiflette not having basic security support, it does provide rate limits on a per field basis.

Request Validations

Total Validation Count: 26

Document Validations	Operation Validations	Field Validations	Argument Validations	Fragment Validations	Value Validations	Directive Validations	Variable Validations	Misc. Validations
Single Root Field	Lone Anonymous Operation	Field Selections on Objects Interfaces and Unions Types	Argument Names	Fragment Must be Used	Values of Correct Type	Directives are Defined	All Variable Usages are Allowed
Executable Definitions	Operation Name Uniqueness	Input Object Field Uniqueness	Argument Uniqueness	Fragment Name Uniqueness		Directives are in Valid Locations	All Variable uses Defined
		Leaf Field Selections	Required Arguments	Fragment Spread is Possible		Directives are Unique per Location	All Variables Used
				Fragment Spread Target Defined			Variable Uniqueness
				Fragment Spread Type Existence			Variables are Input Types
				Fragment Spreads Must Not Form Cycles
				Fragments on Composite Types

Security Disclosure

https://github.com/tartiflette/tartiflette/issues