Page MenuHomePhabricator

Application Security Review Request: webonyx/graphql-php
Closed, ResolvedPublic

Description

Project Information

Description of the tool/project:
PHP implementation of the GraphQL specification based on the reference implementation in JavaScript.

Description of how the tool will be used at WMF:
The Wikibase Reuse Team is currently exploring GraphQL as an alternative data access method. We believe that GraphQL's flexible data retrieval and the ability to traverse linked structures, such as statement properties and statement entity values, are over all a better developer experience for Wikidata/Wikibase data reusers than the existing REST and Action APIs. We also hope to cover some new use cases for which users currently tend to resort to using the SPARQL query service even though no advanced graph queries are needed.

We want to introduce a GraphQL endpoint for Wikibase (Wikibase Repository extension), initially on a Special:WikibaseGraphQL special page (similar to what the GraphQL extension does) to allow read-only queries of item data. As a first step, we will create a prototype to gather user feedback on Beta Wikidata (T399452), and then start the development of the GraphQL endpoint intended for production use after that.

Dependencies
None

Has this project been reviewed before?
No

Working test environment
N/A

Post-deployment
WMDE Engineering / Wikibase Reuse Team

Details

Risk Rating
Low
Related Changes in Gerrit:

Event Timeline

@Jakob_WMDE et al - In chatting with @ATsay-WMF re: timelines, we'll plan to complete this review early next quarter (2025-10-01 to 2025-12-31).

sbassett changed the task status from Open to In Progress.Oct 7 2025, 3:58 PM
sbassett assigned this task to Reedy.
sbassett triaged this task as Medium priority.
sbassett moved this task from Back Orders to In Progress on the secscrum board.

Hi there, checking in on behalf of the Wikibase Reuse team - is the plan to still have the review done by end of this year?

Hi there, checking in on behalf of the Wikibase Reuse team - is the plan to still have the review done by end of this year?

It's still slated to be completed by @Reedy by the end of December 2025.

Hi there, by when can y'all expect to have this done by? We are planning to release by early Feb and I need some time before to check a few things and a date would help me greatly. Thanks!

Hi @Ifrahkhanyaree_WMDE - apologies on behalf of the Security-Team. We’ve reprioritized this review and expect it to be completed by the end of this week.

The results will be posted on 23rd January.

Thanks for your patience.

thanks so much! quick clarification question - what's the difference between it being completed vs. the results being posted? Would it take another month until we can officially use it on production?

thanks so much! quick clarification question - what's the difference between it being completed vs. the results being posted? Would it take another month until we can officially use it on production?

My mistake - I meant January not February.

(ref: https://www.mediawiki.org/wiki/Wikimedia_Security_Team/Third_Party_Code_Review_Checklist)

Security Review Summary - T399459 - 2026-01-23

The vendor code under review appears to have solid security fundamentals. The project is actively maintained and its usage patterns appear sound. No vulnerable dependencies or SAST findings were identified.

However, critical protections such as query depth and query complexity limits are disabled by default. We therefore strongly recommend reviewing the project’s security.md to understand and apply the available mitigations for these potential security weaknesses. Additional recommendations are provided below in the section: General Security Considerations.

The overall risk rating is: low.

graphql-php

General Security Information

Statistic/InfoValueRisk
Repositorygithub none
Relevant tag/branchmaster none
Last commit reviewed (if relevant)e9f08a45 none
Recent contributions to code (6 months)85 low
Active developers with > 10 commits11 low
Current overall usage4.7k stars, 570 forks low
Current open security issues0 none
Methods for reporting security issuesno policy low

Vulnerable Packages
Risk: low

Numerous tools including osv_scanner, composer and various language-specifc audit tools were run and no vulnerabilities were found.

However pointing it out that these 2 packages are abandoned:

Abandoned PackageSuggested Replacement
doctrine/annotationsnone
league/uri-parserleague/uri-interfaces

Outdated Packages
As reported via composer outdated:
(no explicit vulnerabilities reported, simply noting for completeness' sake.)

PackageCurrentWantedLatest (Remediation)
amphp/amp2.6.53.1.13.1.1
amphp/http-server2.1.83.4.33.4.3
phpunit/phpunit10.5.6012.5.612.5.6
psr/http-message1.12.02.0

Scorecard score
5.3 / 10 low
(see output)

General Security Considerations ( medium )

  1. Query Depth and Complexity Attacks - Given that queries might explode exponentially, it is recommended to enforce QueryDepth and QueryComplexity with custom field.
  2. Rate Limiting - The library has no built-in rate limiting. It is recommended to integrate with WMF's rate limiting infrastructure.
  3. Entity Traversal Amplification - Since items can have millions of instances, without pagination limits enforced at the schema level, a single query could attempt to return unbounded result sets leading to resource exhaustion.

Static Analysis Findings
Risk: low

No findings via semgrep and similar tools.

Change #1194238 had a related patch set uploaded (by Jforrester; author: Reedy):

[mediawiki/vendor@master] DMN: Add webonyx/graphql-php (v15.30.0)

https://gerrit.wikimedia.org/r/1194238

Change #1194238 merged by jenkins-bot:

[mediawiki/vendor@master] Add webonyx/graphql-php (v15.30.0)

https://gerrit.wikimedia.org/r/1194238