Why this matters
The graphql-upload library enables file uploads using multipart requests, which can be exploited for CSRF attacks if not properly secured.
Check for the use of graphql-upload. This library enables file uploads using multipart requests, which can be exploited for CSRF attacks if not properly secured.
The graphql-upload library enables file uploads using multipart requests, which can be exploited for CSRF attacks if not properly secured.
Side-by-side examples engineers can pattern-match during review.
app.use(graphqlUploadExpress());app.use(graphqlUploadExpress({
maxFileSize: 1000000,
maxFiles: 10,
})); // Ensure CSRF protection is enabled elsewhere
app.use(graphqlUploadExpress());app.use(graphqlUploadExpress({
maxFileSize: 1000000,
maxFiles: 10,
})); // Ensure CSRF protection is enabled elsewhere
From the same buckets as this rule.