doyensec / inql

InQL is a robust, open-source Burp Suite extension for advanced GraphQL testing, offering intuitive vulnerability detection, customizable scans, and seamless Burp integration.
https://doyensec.com/
Apache License 2.0
1.51k stars 156 forks source link

[Improper parsing]: 6MB file doesn't load in the Burp Extension #109

Closed antoniolortenford closed 1 year ago

antoniolortenford commented 1 year ago

InQL version

BApp Store

GraphQL API

No response

GraphQL specification version

No response

What isn't working?

I'm choosing the json file in the Burp Extension, but it doesn't load. I was able to upload the same file to 'graphl-voyager' and it worked. It's a big file, almost 6 MB but it's not broken. schemaa.zip

antoniolortenford commented 1 year ago

I forgot to add the minified version of the json, that it's 4MB, here it is. schema_mini.zip

execveat commented 1 year ago

Hey, @antoniolortenford! Thank you for reporting a bug.

What is the source of this schema? I'd love to add some real-world schemas to our test suite in order to track regressions.

Parsing works without any issues. Given a large number of queries you might want to use our CLI tool for that (use dev branch for now: https://github.com/doyensec/gqlspection/tree/dev):

$ gqlspection -f schemaa.json

InQL had trouble displaying more than 400 files per folder, but I just pushed fixes, so the next release should support this use case as well.

antoniolortenford commented 1 year ago

Thanks for the information and for looking into this problem! The CLI version works really well, the problem is in the format of the schema because it contains many comments, and the GUI/Extender version auto-fills the format when it has input and removes the comments. (If I'm not mistaken)

This schema is from Indeed, this is the endpoint: https://apis.indeed.com/graphql In the image example, I tried to test the query "conversation" but it has so many comments that it's hard to build the query.

Probably I'll wait until the next release

image