On main: create_project

[jordan-dr]

No description provided.

[dryrunsecurity]

🟡 Please give this pull request extra attention during review.

This pull request contains a security vulnerability in the CreateProject mutation where authentication checks are not implemented, potentially allowing unauthorized project creation by bypassing the existing authorization mechanisms.

🟡 Code Policy: graphql-auth-check

Policy

graphql-auth-check

Result

The CreateProject mutation bypasses authentication by not implementing any authentication checks. While the BaseMutation class provides authorization capabilities through the 'authorize' method and access to current_ability, this mutation doesn't utilize these security mechanisms. Additionally, it accepts a user_id parameter that isn't properly declared as an argument and creates projects without verifying the authenticated user's identity.

---

All finding details can be found in the DryRun Security Dashboard.