Coverage for graphqler / config.py: 100%

1# Configuration 

2 

3"""Debugging purposes""" 

4DEBUG = False 

5 

6"""For proxy""" 

7PROXY = None # Don't use this, this will be overriten by argparse 

8 

9"""For any authentication tokens""" 

10AUTHORIZATION = None # Don't use this, this will be overriten by argparse 

11 

12"""For the compiler / parser""" 

13OUTPUT_DIRECTORY = "graphqler-output" 

14SERIALIZED_DIR_NAME = "serialized" 

15EXTRACTED_DIR_NAME = "extracted" 

16COMPILED_DIR_NAME = "compiled" 

17EVAL_DIR_NAME = "eval" 

18ENDPOINT_RESULTS_DIR_NAME = "endpoint_results" 

19 

20INTROSPECTION_RESULT_FILE_NAME = "introspection_result.json" 

21CONFIG_FILE_NAME = "config.toml" 

22 

23"""Pickle files -- mainly for cross-process communication""" 

24OBJECTS_BUCKET_PICKLE_FILE_NAME = "objects_bucket.pkl" 

25STATS_PICKLE_FILE_NAME = "stats.pkl" 

26 

27QUERY_PARAMETER_FILE_NAME = f"{EXTRACTED_DIR_NAME}/query_parameter_list.yml" 

28MUTATION_PARAMETER_FILE_NAME = f"{EXTRACTED_DIR_NAME}/mutation_parameter_list.yml" 

29OBJECT_LIST_FILE_NAME = f"{EXTRACTED_DIR_NAME}/object_list.yml" 

30INPUT_OBJECT_LIST_FILE_NAME = f"{EXTRACTED_DIR_NAME}/input_object_list.yml" 

31ENUM_LIST_FILE_NAME = f"{EXTRACTED_DIR_NAME}/enum_list.yml" 

32UNION_LIST_FILE_NAME = f"{EXTRACTED_DIR_NAME}/union_list.yml" 

33INTERFACE_LIST_FILE_NAME = f"{EXTRACTED_DIR_NAME}/interface_list.yml" 

34 

35COMPILED_OBJECTS_FILE_NAME = f"{COMPILED_DIR_NAME}/compiled_objects.yml" 

36COMPILED_MUTATIONS_FILE_NAME = f"{COMPILED_DIR_NAME}/compiled_mutations.yml" 

37COMPILED_QUERIES_FILE_NAME = f"{COMPILED_DIR_NAME}/compiled_queries.yml" 

38CHAINS_FILE_NAME = f"{COMPILED_DIR_NAME}/chains.yml" 

39 

40"""For clairvoyance""" 

41WORDLIST_PATH = "" 

42 

43"""For the resolver""" 

44MAX_LEVENSHTEIN_THRESHOLD = 20 # A very high threshold, we could probably lower this, but this almost guarantees us to find a matching object name - ID 

45 

46"""For the LLM-based resolver (opt-in alternative to the classic ID-based resolver) 

47Model string uses litellm format: 

48 OpenAI: "gpt-4o-mini" (set LLM_API_KEY or OPENAI_API_KEY env var) 

49 Anthropic: "anthropic/claude-3-5-haiku-20241022" (set LLM_API_KEY or ANTHROPIC_API_KEY env var) 

50 Ollama: "ollama/llama3" (set LLM_BASE_URL to "http://localhost:11434") 

51 LiteLLM proxy: "openai/my-model" (set LLM_BASE_URL to your proxy URL) 

52""" 

53USE_LLM = False # Master toggle: use LLM for dependency graph inference 

54LLM_MODEL = "gpt-4o-mini" # litellm model string (encodes provider + model) 

55LLM_API_KEY = "" # API key; if empty, reads from env (OPENAI_API_KEY, ANTHROPIC_API_KEY, etc.) 

56LLM_BASE_URL = "" # Custom base URL (required for Ollama and LiteLLM proxies) 

57LLM_RESOLVER_FALLBACK_TO_ID = True # Fall back to classic ID-based resolver if LLM call fails 

58LLM_RESOLVER_SAVE_COMPARISON = True # Save a side-by-side comparison JSON of LLM vs classic results 

59LLM_MAX_RETRIES = 2 # How many times to retry when the LLM returns non-JSON 

60 

61"""For the linker""" 

62GRAPH_VISUALIZATION_OUTPUT = "dependency_graph.png" 

63 

64"""General Graphql definitions: https://spec.graphql.org/October2021/""" 

65BUILT_IN_TYPES = ["ID", "Int", "Float", "String", "Boolean"] 

66BUILT_IN_TYPE_KINDS = ["SCALAR", "OBJECT", "INTERFACE", "UNION", "ENUM", "INPUT_OBJECT", "LIST", "NON_NULL"] 

67 

68"""For materializers""" 

69MAX_OBJECT_CYCLES = 5 

70MAX_OUTPUT_SELECTOR_DEPTH = 5 

71HARD_CUTOFF_DEPTH = 20 

72MAX_INPUT_DEPTH = 20 

73 

74"""For loggers""" 

75FUZZER_LOG_FILE_PATH = "logs/fuzzer.log" 

76COMPILER_LOG_FILE_PATH = "logs/compiler.log" 

77DETECTOR_LOG_FILE_PATH = "logs/detector.log" 

78IDOR_LOG_FILE_PATH = "logs/idor.log" 

79 

80"""For stats""" 

81STATS_FILE_NAME = "stats.txt" 

82OBJECTS_BUCKET_TEXT_FILE_NAME = "objects_bucket.txt" 

83UNIQUE_RESPONSES_FILE_NAME = "unique_responses.txt" 

84 

85"""For plugins""" 

86PLUGINS_PATH = f"{OUTPUT_DIRECTORY}/plugins" 

87 

88"""For using GraphQLer in different modes""" 

89USE_OBJECTS_BUCKET = True # This mode is for when we want to use the objects bucket 

90USE_DEPENDENCY_GRAPH = True # This mode is for when we want to use DFS through the dependency graph 

91NO_DATA_COUNT_AS_SUCCESS = False # This mode is for when we want to count no data in the data object as a success or failure 

92DISABLE_MUTATIONS = False # When True, only Query chains are generated — all Mutation nodes are excluded from fuzzing 

93 

94"""For fuzzing""" 

95ALLOW_DELETION_OF_OBJECTS = False # This mode is for when we want to allow the deletion of objects from the objects bucket when coming across a DELETE mutation success 

96MAX_FUZZING_ITERATIONS = 5 

97MAX_TIME = 3600 # in seconds 

98SKIP_MAXIMAL_PAYLOADS = False # This mode is for when we want to skip the maximal payloads 

99SKIP_DOS_ATTACKS = True # This mode is for when we want to skip the DoS check 

100SKIP_INJECTION_ATTACKS = False # This mode is for when we want to skip the injection check 

101SKIP_MISC_ATTACKS = False # This mode is for when we want to skip the miscellaneous attacks 

102 

103"""For each request""" 

104REQUEST_TIMEOUT = 120 # in seconds 

105TIME_BETWEEN_REQUESTS = 0.001 # in seconds 

106 

107"""For custom skipping nodes""" 

108SKIP_NODES = [] 

109 

110"""For custom headers""" 

111CUSTOM_HEADERS = {}