Coverage for graphqler / fuzzer / engine / detectors / introspection / introspection_detector.py: 92%

1from typing import Type 

2 

3import requests 

4 

5from .introspection_materializer import IntrospectionMaterializer 

6from ..detector import Detector 

7 

8 

9class IntrospectionDetector(Detector): 

10 @property 

11 def DETECTION_NAME(self) -> str: 

12 return "Introspection Enabled" 

13 

14 @property 

15 def detect_only_once_for_api(self) -> bool: 

16 return True 

17 

18 @property 

19 def detect_only_once_for_node(self) -> bool: 

20 return True 

21 

22 @property 

23 def materializer(self) -> Type[IntrospectionMaterializer]: 

24 return IntrospectionMaterializer 

25 

26 def _is_vulnerable(self, graphql_response: dict, request_response: requests.Response) -> bool: 

27 if graphql_response is None: 

28 return False 

29 if 'errors' in graphql_response: 

30 return False 

31 return "__schema" in graphql_response['data'] and request_response.status_code == 200 

32 

33 def _is_potentially_vulnerable(self, graphql_response: dict, request_response: requests.Response) -> bool: 

34 return self._is_vulnerable(graphql_response, request_response)