Security context

What an agent needs to avoid regressing past fixes and find the next vuln in this repo.

graphql-python/graphene-django

              main @ f02ea33
            

Fixes

CVEs

HIGH

Peak severity

100.0%

Coverage

Highlights

Auth Bypass: 2 prior fixes. Scrutinize any change in this area.

graphene_django/views.py: most-fixed (2 issues). Treat as high-risk during review.

2 high-severity fixes in this history; regressions here are high-impact.

Recurring patterns

The bug types that recur here, drawn from past fixes, not open vulnerabilities.

Auth Bypass: One-to-one relationship resolvers bypassed custom object-level access controls, requiring queries to be explicitly routed through DjangoObjectType `get_queryset` and `get_node` methods to prevent unauthorized data exposure.

Auth Bypass: Relay connection resolutions bypassed customized `get_queryset` constraints, allowing clients to query node connections they should not have access to.

CSRF: The main GraphQLView dispatch entry point did not guarantee CSRF protection, requiring explicit cookie enforcement decorators.