Craft affected by IDOR via GraphQL @parseRefs

@@ -9,6 +9,7 @@
 ### Development
 - Added support for referencing environment variables anywhere within settings that support them (e.g. `foo/$ENV_NAME/bar` or `foo-${ENV_NAME}-bar`). ([#17949](https://github.com/craftcms/cms/pull/17949))
 - Added the `uuid()` Twig function.
+- The `@parseRefs` GraphQL directive is now optional for each GraphQL schema. (GHSA-7x43-mpfg-r9wj)
 
 ### Extensibility
 - Added `craft\services\Search::deleteOrphanedIndexJobs()`.

@@ -4,7 +4,7 @@
     'id' => 'CraftCMS',
     'name' => 'Craft CMS',
     'version' => '4.16.17',
-    'schemaVersion' => '4.17.0.0',
+    'schemaVersion' => '4.17.0.1',
     'minVersionRequired' => '3.7.11',
     'basePath' => dirname(__DIR__), // Defines the @app alias
     'runtimePath' => '@storage/runtime', // Defines the @runtime alias

@@ -352,6 +352,8 @@ public static function createFullAccessSchema(): GqlSchema
             $traverser($group);
         }
 
+        $schema->scope[] = 'directive:parseRefs';
+
         return $schema;
     }
 

@@ -0,0 +1,40 @@
+<?php
+
+namespace craft\migrations;
+
+use Craft;
+use craft\db\Migration;
+
+/**
+ * m260105_191335_parseRefs_schema_component migration.
+ */
+class m260105_191335_parseRefs_schema_component extends Migration
+{
+    /**
+     * @inheritdoc
+     */
+    public function safeUp(): bool
+    {
+        $gql = Craft::$app->getGql();
+        $schemas = $gql->getSchemas();
+
+        foreach ($schemas as $schema) {
+            if (in_array('directive:parseRefs', $schema->scope)) {
+                continue;
+            }
+
+            $schema->scope[] = 'directive:parseRefs';
+            $gql->saveSchema($schema);
+        }
+
+        return true;
+    }
+
+    /**
+     * @inheritdoc
+     */
+    public function safeDown(): bool
+    {
+        return true;
+    }
+}

@@ -375,7 +375,7 @@ public function getSchemaDef(?GqlSchema $schema = null, bool $prebuildSchema = f
                 'typeLoader' => TypeLoader::class . '::loadType',
                 'query' => TypeLoader::loadType('Query'),
                 'mutation' => TypeLoader::loadType('Mutation'),
-                'directives' => $this->_loadGqlDirectives(),
+                'directives' => $this->_loadGqlDirectives($schema),
             ];
 
             // If we're not required to pre-build the schema the relevant GraphQL types will be added to the Schema
@@ -1391,21 +1391,25 @@ private function _registerGqlMutations(): void
     /**
      * Get GraphQL query definitions
      *
+     * @param GqlSchema|null $schema
      * @return GqlDirective[]
      */
-    private function _loadGqlDirectives(): array
+    private function _loadGqlDirectives(?GqlSchema $schema): array
     {
         /** @var class-string<Directive>[] $directiveClasses */
         $directiveClasses = [
             // Directives
             FormatDateTime::class,
             Markdown::class,
             Money::class,
-            ParseRefs::class,
             StripTags::class,
             Trim::class,
         ];
 
+        if (in_array('directive:parseRefs', $schema->scope)) {
+            $directiveClasses[] = ParseRefs::class;
+        }
+
         if (!Craft::$app->getConfig()->getGeneral()->disableGraphqlTransformDirective) {
             $directiveClasses[] = Transform::class;
         }

@@ -35,7 +35,7 @@
 
             <li>
                 {{ checkbox({
-                    label: props.label,
+                    label: raw(props.label|md(inlineOnly=true, encode=true)),
                     name: 'permissions[]',
                     value: permissionName,
                     checked: checked,
@@ -101,7 +101,7 @@
         </div>
     {% endfor %}
 
-    <hr/>
+    <hr>
     <h2>{{ 'Choose the available mutations for this schema:'|t('app') }}</h2>
 
     {% for category, catPermissions in schemaComponents.mutations|filter %}
@@ -113,6 +113,19 @@
         </div>
     {% endfor %}
 
+  <hr>
+  <h2>{{ 'Choose optional features available to this schema:'|t('app') }}</h2>
+
+  <div class="user-permissions">
+    {{ permissionList(schema, {
+      'directive:parseRefs': {
+        label: '{name} directive'|t('app', {
+          name: '`@parseRefs`',
+        }),
+        warning: 'Provides read-only access to user data and most content.',
+      },
+    }) }}
+  </div>
 
 {% endblock %}
 

@@ -1154,6 +1154,7 @@
     'Propagating {type}' => 'Propagating {type}',
     'Propagation Key Format' => 'Propagation Key Format',
     'Propagation Method' => 'Propagation Method',
+    'Provides read-only access to user data and most content.' => 'Provides read-only access to user data and most content.',
     'Province' => 'Province',
     'Pruning extra revisions' => 'Pruning extra revisions',
     'Public Schema' => 'Public Schema',
@@ -1977,6 +1978,7 @@
     '{first}-{last} of {total}' => '{first}–{last} of {total}',
     '{names} {total, plural, =1{is installed as a trial} other{are installed as trials}}.' => '{names} {total, plural, =1{is installed as a trial} other{are installed as trials}}.',
     '{name} active, more info' => '{name} active, more info',
+    '{name} directive' => '{name} directive',
     '{name} folder' => '{name} folder',
     '{name} has been added, but an error occurred when installing it.' => '{name} has been added, but an error occurred when installing it.',
     '{name} is licensed for the {licenseEdition} edition, but the {currentEdition} edition is installed.' => '{name} is licensed for the {licenseEdition} edition, but the {currentEdition} edition is installed.',