GraphQL queries sanitizing

[quentinovega]

Description

A security vulnerability has been identified in Daikoku's GraphQL API. Several queries are publicly exposed without authentication, allowing unauthenticated users to retrieve sensitive data

Problem

• Some GraphQL queries that directly map domain objects (POJOs) are accessible without authentication
• Sensitive fields are returned in query responses

Expected behavior

• Only queries actively used by the frontend should be exposed
• Sensitive fields should never be returned in GraphQL responses
• Queries exposing personal or critical data should require authentication

Action plan

1. Audit exposed queries — Identify all GraphQL queries that directly map POJOs. Cross-reference with frontend usage to determine which ones are actually needed.
2. Remove unused queries — Delete any query not consumed by the frontend.
3. Sanitize response fields — Update the GraphQL middleware to strip sensitive fields from responses, regardless of the caller.
4. Enforce authentication — For queries that must remain but expose user data, restrict access to authenticated users only via the middleware.