GMS-2020-67: Introspection in schema validation in Apollo Server
(updated )
If subscriptions: false
is passed to the ApolloServer
constructor options, there is no impact. If implementors were not expecting validation rules to be enforced on the WebSocket subscriptions transport and are unconcerned about introspection being enabled on the WebSocket subscriptions transport (or were not expecting that), then this advisory is not applicable. If introspection: true
is passed to the ApolloServer
constructor options, the impact is limited to user-provided validation rules (i.e., using validationRules
) since there would be no expectation that introspection was disabled.
References
Detect and mitigate GMS-2020-67 with GitLab Dependency Scanning
Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Learn more about Dependency Scanning →