feat: Improve Application Security

[adintegra]

Tightening up security of the application in general:

• Implement CSP
• Better sanitisation of GraphQL queries to ensure only permitted datasources are used (addresses BAFU vulnerability report)

[vercel]

The latest updates on your projects. Learn more about Vercel for Git ↗︎

Name	Status	Preview	Comments	Updated (UTC)
visualization-tool	✅ Ready (Inspect)	Visit Preview	💬 Add feedback	Jan 14, 2025 10:55am

[adintegra]

@wereHamster, making these changes primarily due to the BAFU's report, but also generally, to improve overall security. Do you think the added headers make sense?

[ptbrowne]

I added validation of the data source url so that we could only used urls that are whitelisted in datasourceUrl.

I tried with https://www.npmjs.com/package/graphql-constraint-directive but could not make it work and it seems the directive only worked if the field was nested inside an object, which would have required a refactor of places using datasourceUrl.

Instead, I used a custom scalar, which also can be used for providing additional validation rules on existing scalars (see https://www.apollographql.com/docs/apollo-server/schema/custom-scalars).

[adintegra]

Thanks @ptbrowne! Looks like this would be a good solution 👍🏼

Did you have issues with graphql-constraint-directive because of the version maybe? I initially missed the note about having to use v2 with graphql v15.

[ptbrowne]

I do not know, I did not see this note either, could be. Did it work for you ?

[bprusinowski]

Thanks @adintegra, I am not 100% sure how to test the change, but overall looks good!

One maintenance thing I'd consider would be to add a CHANGELOG entry, mentioning that the security of the application has been improved 🔒