GHSA-733v-p3h5-qpq7: GraphQL Armor Cost-Limit Plugin Bypass via Introspection Query Obfuscation

The vulnerability lies in the computeComplexity method of the CostLimitVisitor class. The provided patch directly modifies this function to correct a condition that allowed bypassing the cost-limit feature. The original code checked if a node was named __schema and ignoreIntrospection was true, then returned 0, effectively ignoring the cost. This check was too permissive as it applied to various node types (FieldNode, FragmentDefinitionNode, InlineFragmentNode, OperationDefinitionNode, FragmentSpreadNode) instead of just FieldNode for introspection queries. The fix adds node.kind === Kind.FIELD to the condition, ensuring that only actual introspection field queries are ignored. The vulnerability is triggered when a malicious query or fragment is named __schema, causing computeComplexity to incorrectly calculate the cost as zero, thus bypassing the intended security control.

The test cases added in packages/plugins/cost-limit/test/index.spec.ts further confirm this by demonstrating that queries and fragments named __schema now correctly have their costs calculated and are limited if they exceed the maxCost, whereas previously they would have been ignored due to the flaw in computeComplexity.

Therefore, CostLimitVisitor.computeComplexity is the specific function that, in its vulnerable state, would be involved in processing the malicious input and failing to enforce the cost limit, making it a key runtime indicator during exploitation attempts that leverage this bypass.