Coverage for graphqler / fuzzer / engine / detectors / xss_injection / xss_injection_detector.py: 67%

1from typing import Type 

2 

3import requests 

4 

5from .xss_injection_materializer import XSSInjectionMaterializer 

6from ..detector import Detector 

7 

8XSS_PAYLOAD = "<script>alert(1)</script>" 

9 

10 

11class XSSInjectionDetector(Detector): 

12 @property 

13 def DETECTION_NAME(self) -> str: 

14 return "Cross-Site Scripting (XSS) Injection" 

15 

16 @property 

17 def detect_only_once_for_api(self) -> bool: 

18 return False 

19 

20 @property 

21 def detect_only_once_for_node(self) -> bool: 

22 return True 

23 

24 @property 

25 def materializer(self) -> Type[XSSInjectionMaterializer]: 

26 return XSSInjectionMaterializer 

27 

28 def _is_vulnerable(self, graphql_response: dict, request_response: requests.Response) -> bool: 

29 # Confirmed vulnerable: payload reflected verbatim in the raw HTTP response 

30 return request_response.status_code == 200 and XSS_PAYLOAD in request_response.text 

31 

32 def _is_potentially_vulnerable(self, graphql_response: dict, request_response: requests.Response) -> bool: 

33 if graphql_response is None: 

34 return False 

35 # Potentially vulnerable: any part of the payload reflected in the response body 

36 return request_response.status_code == 200 and ("<script>" in request_response.text or "alert(1)" in request_response.text)