GraphQL import

239 views

Skip to first unread message

Larc Gittesom

unread,

May 28, 2021, 1:09:36 PM5/28/21

to OWASP ZAP Developer Group

Hi i'm experimenting importing graphql schemas exported from AWS appsync in both json and schema formats. In both cases they fail to import either via the gui or command line. can anyone give me an example schema so i can try and figure out why?

I get the following errors with AWS exported .schema

485083 [ZAP-GraphQL-Parser5] ERROR org.zaproxy.addon.graphql.GraphQlParser - errors=[The field type 'AWSDateTime' is not present when resolving type 'Asset' [@49:1], The field type 'AWSEmail' is not present when resolving type 'Asset' [@49:1], The field type 'AWSDateTime' is not present when resolving type 'Asset' [@49:1], The field type 'AWSDateTime' is not present

with the .json version it complains that the json is not formed correctly with unexpected "Data"

ricekot

unread,

May 28, 2021, 1:45:22 PM5/28/21

to OWASP ZAP Developer Group

Hello.

At the moment, the GraphQL add-on only supports importing schemas in the GraphQL Schema Definition Language (the .schema file that you mentioned) or via introspection. It seems likely that the issue that you are facing is because AWS AppSync uses custom scalars (like AWSDateTime or AWSEmail) that are not a part of the GraphQL specification, and the parser is unable to parse them.

I suggest trying to use introspection on the endpoint you're going to be querying (Go to Import a GraphQL Schema from a URL and enter in the Endpoint URL only).

Another solution may be to replace the AWS scalar types with "String" throughout your schema file and then try importing it. That should allow you to generate queries from the schema.

Note that if a query argument is also one of these AWS scalars, the default value that will be passed to it will be a string ("ZAP"). You can override these with the Form Handler add-on.