Open actionable advisories and recorded vendor fixes. This public package view has no inventory attached and cannot establish whether your deployment is affected. A vendor fix never resolves your finding; verify your installed version and the source guidance.
Open advisories
2 actionable advisories, newest first. Withdrawn advisories and news are excluded. Coverage is partial.
Original message: I found an issue with security grants on on properties in the GraphQL ItemNormalizer: If you use something like #[ApiProperty(security: 'isgranted("PROPERTYREAD", [object, property])')] on a member of an entity, the grant gets cached and is only evaluated once, even if the object in question is a different one. There is the ApiPlatform\GraphQl\Serializer\ItemNormalizer::isCacheKeySafe() method that seems to be intended to prevent this: https://github.com/api-platform/core/blob/88f5ac50d20d6510686a7552310cc567fcca45bf/src/GraphQl/Serializer/ItemNormalizer.php#L160-L164 and in its usage on line 90 it does indeed not create a cache key, but the parent::normalize() that is called afterwards still creates the cache key and causes the issue. Impact It grants access to properties that it should not. Workarounds Override the ItemNormalizer. Patched at: https://github.com/api-platform/core/commit/7af65aad13037d7649348ee3dcd88e084ef771f8
Recommended action: Upgrade to 4.1.5, 4.0.22 or 3.4.17 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Using the Relay special node type you can bypass the configured security on an operation. Details Here is an example of how to apply security configurations for the GraphQL operations: This indeed checks isgranted('ROLEUSER') as expected for a GraphQL query like the following: But the security check can be bypassed by using the node field (that is available by default) on the root query type like that: This does not execute any security checks and can therefore be used to access any entity without restrictions by everyone that has access to the API. Impact Everyone using GraphQl with the security attribute. Not sure whereas this works with custom resolvers nor if this also applies on mutation. Patched at https://github.com/api-platform/core/commit/60747cc8c2fb855798c923b5537888f8d0969568
Recommended action: Upgrade to 4.1.5, 4.0.22 or 3.4.17 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.