Documentation
¶
Overview ¶
Package graphqlx provides transport-agnostic GraphQL logic shared by the scanner modules: the canonical introspection query, a schema model parsed from an introspection response, a builder that turns a schema into concrete operations (mirroring how an OpenAPI spec is expanded into requests), typed example-value synthesis, and lightweight detection/fingerprint helpers.
Nothing here performs I/O — callers own the HTTP layer — so the package is pure and cheaply unit-testable.
Index ¶
- Constants
- func ConfirmsTypename(body []byte) bool
- func IntrospectionBody() string
- func LooksLikeGraphQLResponse(body []byte) bool
- func LooksLikeIntrospection(body []byte) bool
- func QueryBody(query string) string
- func QuoteString(s string) string
- type BuildOptions
- type Field
- type IDLookupField
- type InputValue
- type OpKind
- type Operation
- type Schema
- type Type
- type TypeRef
Constants ¶
const ( // DefaultMaxOperations bounds fed traffic so an enormous schema cannot flood // the pipeline. DefaultMaxOperations = 40 // DefaultMaxSelectionFields bounds selection-set width per operation. DefaultMaxSelectionFields = 6 )
const ( KindScalar = "SCALAR" KindObject = "OBJECT" KindInterface = "INTERFACE" KindUnion = "UNION" KindEnum = "ENUM" KindInputObject = "INPUT_OBJECT" KindList = "LIST" KindNonNull = "NON_NULL" )
Kind constants for GraphQL type kinds as returned by introspection.
const IntrospectionQuery = `` /* 500-byte string literal not displayed */
IntrospectionQuery is the canonical full introspection query (fragment-free, depth-bounded ofType chain) used to enumerate the complete schema. It matches the OWASP WSTG reference query and the depth used by the jsext helper.
const TypenameQuery = `{"query":"{ __typename }"}`
TypenameQuery is the minimal probe used to confirm an endpoint speaks GraphQL.
Variables ¶
This section is empty.
Functions ¶
func ConfirmsTypename ¶
ConfirmsTypename reports whether a probe response actually reflects the __typename query result, i.e. a real GraphQL engine answered. A generic 200 JSON page or GraphiQL HTML will not carry both the data envelope and the echoed __typename key.
func IntrospectionBody ¶
func IntrospectionBody() string
IntrospectionBody returns the JSON request body carrying the full introspection query, ready to POST with Content-Type application/json.
func LooksLikeGraphQLResponse ¶
LooksLikeGraphQLResponse reports whether a response body is plausibly from a GraphQL backend: it must be JSON-shaped and carry a GraphQL envelope key ("data" or a spec-shaped "errors" array), not merely contain the word graphql. This is a necessary (not sufficient) signal — callers combine it with a positive probe (e.g. __typename echoed back).
func LooksLikeIntrospection ¶
LooksLikeIntrospection reports whether a response body is a GraphQL introspection result, cheaply (substring), without full parsing. Requires the __schema marker plus a structural companion so a request that merely echoes "__schema" as a string does not match.
func QuoteString ¶
QuoteString returns query, escaped as a GraphQL string literal.
Types ¶
type BuildOptions ¶
type BuildOptions struct {
// IncludeMutations enables synthesizing mutation operations. Off by default:
// mutations change state, so they are only exercised under an explicit
// aggressive/deep opt-in.
IncludeMutations bool
// MaxOperations caps the number of operations returned (0 → DefaultMaxOperations).
MaxOperations int
// MaxSelectionFields caps leaf fields selected per object return type
// (0 → DefaultMaxSelectionFields).
MaxSelectionFields int
// OnlyArgless restricts generation to root fields with no required args —
// the safest, most data-yielding subset (pure enumeration).
OnlyArgless bool
}
BuildOptions tunes operation generation.
type Field ¶
type Field struct {
Name string
Args []*InputValue
Type *TypeRef
}
Field is a field on an object/interface type.
type IDLookupField ¶
IDLookupField is a root query field that fetches a single object by an id-like scalar argument — the BOLA/IDOR probe surface.
func (IDLookupField) IDArgType ¶
func (l IDLookupField) IDArgType() string
IDArgType returns the named type of the identifier argument ("ID", "Int", …).
type InputValue ¶
type InputValue struct {
Name string
Type *TypeRef
DefaultValue string // raw GraphQL literal, "" when absent
}
InputValue is a field argument or an input-object field.
type Operation ¶
type Operation struct {
Kind OpKind
RootField string // the root field this operation invokes
Query string // the raw GraphQL document
Body string // JSON POST body
ArgNames []string // required argument names filled (for reporting)
}
Operation is a concrete, ready-to-send GraphQL operation synthesized from the schema. Body is the JSON request body ({"query":"..."}).
func BuildOperations ¶
func BuildOperations(s *Schema, opts BuildOptions) []Operation
BuildOperations enumerates the root query (and optionally mutation) fields and synthesizes a minimal valid operation for each: required arguments filled with typed example literals, and a leaf-biased selection set for object returns. A root field is skipped when any required argument cannot be confidently rendered, so every emitted operation is well-formed rather than garbage.
type Schema ¶
type Schema struct {
QueryType string
MutationType string
SubscriptionType string
Types []*Type
// contains filtered or unexported fields
}
Schema is the subset of an introspection result needed to build operations.
func ParseSchema ¶
ParseSchema decodes an introspection response body into a Schema. It returns (nil, false) when the body is not a usable introspection result (no __schema, or no types) so callers can cheaply gate on the boolean.
func (*Schema) DepthProbe ¶
DepthProbe builds a deeply-nested query by following a self-referential object relationship reachable from an argument-free root query field, to the given depth. It returns ("", false) when the schema has no usable cycle. The probe is a single non-amplified query (no aliasing, no large list arguments) — its only purpose is to observe whether the server enforces a depth/complexity limit, never to exhaust resources.
func (*Schema) IDLookupFields ¶
func (s *Schema) IDLookupFields() []IDLookupField
IDLookupFields returns root query fields that take an "id" argument and return a single (non-list) object — where every other required argument is renderable. These are the fields probed for predictable-ID object access.
func (*Schema) QueryFields ¶
QueryFields returns the root query fields (nil-safe, introspection fields excluded).
func (*Schema) RenderProbe ¶
RenderProbe builds a query document invoking f with its id argument set to idLiteral (a ready GraphQL literal) and all other required args auto-filled, selecting leaf fields. Returns ("", false) if a required arg is unrenderable.
func (*Schema) TypeByName ¶
TypeByName returns the named type or nil.
type Type ¶
type Type struct {
Kind string
Name string
Fields []*Field
InputFields []*InputValue
EnumValues []string
}
Type is a named GraphQL type from the schema.
type TypeRef ¶
TypeRef is a possibly-wrapped reference to a type (NON_NULL / LIST wrappers around a named type).
func (*TypeRef) IsList ¶
IsList reports whether the type is a list at any wrapper level below an optional leading NON_NULL.
func (*TypeRef) IsRequired ¶
IsRequired reports whether the outermost wrapper is NON_NULL (and the type has no default value — callers pass the default separately).