Merge pull request #20492 from Napalys/js/graph-ql-obj-type

JS: mark `GraphQLObjectType` resolvers args as remote sources

Author: Napalys

javascript/ql/lib/change-notes/2025-09-19-graphql-type-object.md

@@ -0,0 +1,4 @@
+---
+category: minorAnalysis
+---
+* Added modeling of `GraphQLObjectType` resolver function parameters as remote sources.

javascript/ql/lib/ext/graph-ql.model.yml

@@ -4,3 +4,8 @@ extensions:
       extensible: summaryModel
     data:
       - ["graphql", "Member[graphql]", "Argument[0].Member[source,variableValues]", "Argument[0].Member[rootValue].AnyMember.Parameter[0]", "taint"]
+  - addsTo:
+      pack: codeql/javascript-all
+      extensible: sourceModel
+    data:
+      - ["graphql", "Member[GraphQLObjectType].Argument[0].Member[fields].AnyMember.Member[resolve].Parameter[1]", "remote"]

javascript/ql/test/query-tests/Security/CWE-094/CodeInjection/CodeInjection.expected

@@ -63,6 +63,7 @@
 | fastify.js:108:28:108:50 | reply.l ... tedCode | fastify.js:94:29:94:51 | request ... plyCode | fastify.js:108:28:108:50 | reply.l ... tedCode | This code execution depends on a $@. | fastify.js:94:29:94:51 | request ... plyCode | user-provided value |
 | graph-ql.js:20:19:20:22 | expr | graph-ql.js:28:32:28:39 | req.body | graph-ql.js:20:19:20:22 | expr | This code execution depends on a $@. | graph-ql.js:28:32:28:39 | req.body | user-provided value |
 | graph-ql.js:39:19:39:30 | name + title | graph-ql.js:28:32:28:39 | req.body | graph-ql.js:39:19:39:30 | name + title | This code execution depends on a $@. | graph-ql.js:28:32:28:39 | req.body | user-provided value |
+| graph-ql.js:66:23:66:27 | value | graph-ql.js:65:22:65:30 | { value } | graph-ql.js:66:23:66:27 | value | This code execution depends on a $@. | graph-ql.js:65:22:65:30 | { value } | user-provided value |
 | module.js:9:16:9:29 | req.query.code | module.js:9:16:9:29 | req.query.code | module.js:9:16:9:29 | req.query.code | This code execution depends on a $@. | module.js:9:16:9:29 | req.query.code | user-provided value |
 | module.js:11:17:11:30 | req.query.code | module.js:11:17:11:30 | req.query.code | module.js:11:17:11:30 | req.query.code | This code execution depends on a $@. | module.js:11:17:11:30 | req.query.code | user-provided value |
 | react-native.js:8:32:8:38 | tainted | react-native.js:7:17:7:33 | req.param("code") | react-native.js:8:32:8:38 | tainted | This code execution depends on a $@. | react-native.js:7:17:7:33 | req.param("code") | user-provided value |
@@ -173,6 +174,8 @@ edges
 | graph-ql.js:39:19:39:22 | name | graph-ql.js:39:19:39:30 | name + title | provenance |  |
 | graph-ql.js:39:26:39:30 | title | graph-ql.js:39:19:39:30 | name + title | provenance |  |
 | graph-ql.js:54:21:54:29 | variables | graph-ql.js:38:13:38:27 | { name, title } | provenance |  |
+| graph-ql.js:65:22:65:30 | { value } | graph-ql.js:65:24:65:28 | value | provenance |  |
+| graph-ql.js:65:24:65:28 | value | graph-ql.js:66:23:66:27 | value | provenance |  |
 | react-native.js:7:7:7:13 | tainted | react-native.js:8:32:8:38 | tainted | provenance |  |
 | react-native.js:7:7:7:13 | tainted | react-native.js:10:23:10:29 | tainted | provenance |  |
 | react-native.js:7:17:7:33 | req.param("code") | react-native.js:7:7:7:13 | tainted | provenance |  |
@@ -323,6 +326,9 @@ nodes
 | graph-ql.js:39:19:39:30 | name + title | semmle.label | name + title |
 | graph-ql.js:39:26:39:30 | title | semmle.label | title |
 | graph-ql.js:54:21:54:29 | variables | semmle.label | variables |
+| graph-ql.js:65:22:65:30 | { value } | semmle.label | { value } |
+| graph-ql.js:65:24:65:28 | value | semmle.label | value |
+| graph-ql.js:66:23:66:27 | value | semmle.label | value |
 | module.js:9:16:9:29 | req.query.code | semmle.label | req.query.code |
 | module.js:11:17:11:30 | req.query.code | semmle.label | req.query.code |
 | react-native.js:7:7:7:13 | tainted | semmle.label | tainted |

javascript/ql/test/query-tests/Security/CWE-094/CodeInjection/HeuristicSourceCodeInjection.expected

@@ -72,6 +72,8 @@ edges
 | graph-ql.js:39:19:39:22 | name | graph-ql.js:39:19:39:30 | name + title | provenance |  |
 | graph-ql.js:39:26:39:30 | title | graph-ql.js:39:19:39:30 | name + title | provenance |  |
 | graph-ql.js:54:21:54:29 | variables | graph-ql.js:38:13:38:27 | { name, title } | provenance |  |
+| graph-ql.js:65:22:65:30 | { value } | graph-ql.js:65:24:65:28 | value | provenance |  |
+| graph-ql.js:65:24:65:28 | value | graph-ql.js:66:23:66:27 | value | provenance |  |
 | react-native.js:7:7:7:13 | tainted | react-native.js:8:32:8:38 | tainted | provenance |  |
 | react-native.js:7:7:7:13 | tainted | react-native.js:10:23:10:29 | tainted | provenance |  |
 | react-native.js:7:17:7:33 | req.param("code") | react-native.js:7:7:7:13 | tainted | provenance |  |
@@ -224,6 +226,9 @@ nodes
 | graph-ql.js:39:19:39:30 | name + title | semmle.label | name + title |
 | graph-ql.js:39:26:39:30 | title | semmle.label | title |
 | graph-ql.js:54:21:54:29 | variables | semmle.label | variables |
+| graph-ql.js:65:22:65:30 | { value } | semmle.label | { value } |
+| graph-ql.js:65:24:65:28 | value | semmle.label | value |
+| graph-ql.js:66:23:66:27 | value | semmle.label | value |
 | module.js:9:16:9:29 | req.query.code | semmle.label | req.query.code |
 | module.js:11:17:11:30 | req.query.code | semmle.label | req.query.code |
 | react-native.js:7:7:7:13 | tainted | semmle.label | tainted |

javascript/ql/test/query-tests/Security/CWE-094/CodeInjection/graph-ql.js

@@ -1,5 +1,5 @@
 const express = require('express');
-const { graphql, buildSchema } = require('graphql');
+const { graphql, buildSchema, GraphQLObjectType, GraphQLString } = require('graphql');
 
 const app = express();
 app.use(express.json());
@@ -53,4 +53,30 @@ app.post('/graphql', async (req, res) => {
     rootValue: root1,
     variableValues: variables
   });
+
+  const MutationType = new GraphQLObjectType({
+    name: 'Mutation',
+    fields: {
+      runEval: {
+        type: GraphQLString,
+        args: {
+          value: { type: GraphQLString }
+        },
+        resolve: (_, { value }, context) => { // $ Source[js/code-injection]
+          return eval(value); // $ Alert[js/code-injection]
+        }
+      }
+    }
+  });
+  
+  const schema = new GraphQLSchema({
+    query: QueryType,
+    mutation: MutationType
+  });
+
+  await graphql({
+    schema,
+    source: query,
+    variableValues: variables
+  });
 });