Secure your code as it's written. Use Snyk Code to scan source code in minutes - no build needed - and fix issues immediately.
Main Introspection method.
:param args: arg parser alike arguments
:param print_help: print help lambda
:return: None
"""
# At least one between -t or -f (target) parameters must be set
if args.target is None and args.schema_json_file is None:
print(string_join(red, "Remote GraphQL Endpoint OR a Schema file in JSON format must be specified!", reset))
if print_help:
print_help()
exit(1)
# Only one of them -t OR -f :)
if args.target is not None and args.schema_json_file is not None:
print(string_join(red, "Only a Remote GraphQL Endpoint OR a Schema file in JSON format must be specified, not both!", reset))
if print_help:
print_help()
exit(1)
# Takes care of any configured proxy (-p param)
if args.proxy is not None:
print(string_join(yellow, "Proxy ENABLED: ", args.proxy, reset))
os.environ['http_proxy'] = args.proxy
os.environ['https_proxy'] = args.proxy
# Generate Headers object
headers = {}
if args.headers:
for k, v in args.headers:
headers[k] = v
"""
This function will replace known GraphQL arguments types with placeholder values (useful for Burp Suite Repeater)
:param types:
Known types: String, Boolean, Float, Int, NOT_NULL
TODO: add the support for custom objects and lists (partially handled since v4.1)
:return:
Returns a placeholder accordingly to the provided type
"""
# strip the ! character (not null symbol) before returning the type
types = types.replace("!", "")
# Switch between known args types
if "String" in types:
# needed for Burp Repeater string handling
types = string_join('\\"', types, '\\"')
types = types.replace("String", "asd")
elif "Boolean" in types:
types = types.replace("Boolean", "true")
elif "Float" in types:
types = types.replace("Float", "0.5")
elif "Int" in types:
types = types.replace("Int", "1")
return types
# Generate Headers object
headers = {}
if args.headers:
for k, v in args.headers:
headers[k] = v
if args.target is not None or args.schema_json_file is not None:
if args.target is not None:
# Acquire GraphQL endpoint URL as a target
host = urlparse(args.target).netloc
else:
# Acquire a local JSON file as a target
print(string_join(yellow, "Parsing local schema file", reset))
host = os.path.splitext(os.path.basename(args.schema_json_file))[0]
if args.detect:
print(string_join(yellow, "Detect arguments is ENABLED, known types will be replaced with placeholder values", reset))
# Used to generate 'unique' file names for multiple documentation
timestamp = str(int(time.time())) # Can be printed with: str(int(timestamp))
today = str(date.today())
# -----------------------
# Custom Objects are required for fields names in the documentation and templates generation
# old -c parameter, enabled by default
custom = True
# Generate the documentation for the target
if args.target is not None:
# Parse response from the GraphQL endpoint
argument = query_result(target=args.target,
key=args.key,
headers=headers,
verify_certificate=not args.insecure_certificate,
requests=args.requests,
stub_responses=args.stub_responses)
if verify_certificate:
contents = urllib_request.urlopen(request).read()
else:
ctx = ssl.create_default_context()
ctx.check_hostname = False
ctx.verify_mode = ssl.CERT_NONE
contents = urllib_request.urlopen(request, context=ctx).read()
stub_responses[url.netloc] = contents
return contents
except Exception as e:
print(string_join(red, str(e), reset))
green_print=lambda s: print(string_join(green, "Writing Queries Templates", reset)))
os.environ['http_proxy'] = args.proxy
os.environ['https_proxy'] = args.proxy
# Generate Headers object
headers = {}
if args.headers:
for k, v in args.headers:
headers[k] = v
if args.target is not None or args.schema_json_file is not None:
if args.target is not None:
# Acquire GraphQL endpoint URL as a target
host = urlparse(args.target).netloc
else:
# Acquire a local JSON file as a target
print(string_join(yellow, "Parsing local schema file", reset))
host = os.path.splitext(os.path.basename(args.schema_json_file))[0]
if args.detect:
print(string_join(yellow, "Detect arguments is ENABLED, known types will be replaced with placeholder values", reset))
# Used to generate 'unique' file names for multiple documentation
timestamp = str(int(time.time())) # Can be printed with: str(int(timestamp))
today = str(date.today())
# -----------------------
# Custom Objects are required for fields names in the documentation and templates generation
# old -c parameter, enabled by default
custom = True
# Generate the documentation for the target
if args.target is not None:
# Parse response from the GraphQL endpoint
argument = query_result(target=args.target,
key=args.key,
headers=headers,