@asymmetric-effort/specifyjs: GraphQL gql tag allows metacharacter injection

Description

Location: core/src/client/graphql.ts:66-80

The gql template tag function warned about interpolated values containing GraphQL metacharacters ({}():) but still concatenated them into the query string, enabling potential GraphQL injection.

Recommendation

Update the @asymmetric-effort/specifyjs package to the latest compatible version. Followings are version details:

• Affected version(s): < 0.2.136
• Patched version(s): 0.2.136

References

• GHSA-5c7w-4wm3-85vw
• CWE-943
• OWASP 2017-A1

Related Issues

• @asymmetric-effort/specifyjs: No redirect target validation in secureFetch - Vulnerability
• @asymmetric-effort/specifyjs: `data:` URI allowed without size restriction - Vulnerability
• @asymmetric-effort/specifyjs: Localhost bypass incomplete (IPv6, 0.0.0.0, 127.x range) - Vulnerability
• @asymmetric-effort/specifyjs: Production console warnings may leak internal framework state - Vulnerability

You might also like:

How do hackers hack websites?

These 7 PHP mistakes leave your website open to the hackers

Update Cheat Sheet for Developers

Tags:

npm

@asymmetric-effort/specifyjs