[LI-197038] Prevent GraphQL injection in transfer method configuration queries

[brsouzapaypal]

Summary

Fixes a GraphQL injection vulnerability (CWE-943, LI-197038) in the transfer method configuration queries. Caller-supplied values were interpolated directly into the GraphQL query string via String(format:), so a crafted value could terminate its field and append arbitrary GraphQL (e.g. an introspection selection).

Changes

• GraphQlQuery: new protocol-extension helpers
  • sanitizeGraphQlLiteral(_:): allowlist of GraphQL-name characters for values interpolated as unquoted enum/scalar literals.
  • escapeGraphQlString(_:): escapes \ and " for values embedded inside quoted strings.
• Wired the helpers into every query that interpolates caller input:
  • HyperwalletTransferMethodConfigurationFieldQuery (userToken, profile, country, currency, transferMethodType)
  • HyperwalletTransferMethodConfigurationKeysQuery (userToken)
  • HyperwalletTransferMethodTypesFeesAndProcessingTimesQuery (userToken, country, currency)
  • HyperwalletTransferMethodUpdateConfigurationFieldQuery (transferMethodToken)

Scope note

The ticket enumerates the field query fields. The fix was intentionally broadened to every query that interpolates caller input (KeysQuery, FeesAndProcessingTimes, and all userToken values), since the same unsafe pattern repeats there.

Testing

• Added unit tests in HyperwalletTransferMethodConfigurationFieldQueryTests covering injection neutralization in unquoted literals, quote escaping in quoted strings, and preservation of valid values for all four queries.
• Validated the output of all four queries locally; legitimate values are unchanged and injection payloads are neutralized.

CI note

The iOS Core SDK CI workflow fails at the Carthage [Install dependencies] step while building the Hippolyte test dependency under Xcode 16.2 (Build Failed, exit code 70), before the project is compiled or the test/lint steps run. This is a pre-existing pipeline failure unrelated to this change.

How this was verified:

1. Enabled GitHub Actions on the fork (disabled by default on forks) and dispatched the iOS Core SDK CI workflow against this branch.
   • Run: https://github.com/brsouzapaypal/hyperwallet-ios-sdk/actions/runs/37376348551
   • It failed in the Carthage [Install dependencies] step; the Run (tests) and Lint validation steps never executed.
2. Cross-checked the upstream master CI run, which fails at the same early stage, confirming the failure predates this change.
   • Run: https://github.com/hyperwallet/hyperwallet-ios-sdk/actions/runs/18120336698

Because the dependency build fails before the test phase, the test and lint steps cannot execute in CI until the Hippolyte build is repaired. The added XCTest cases will run once the pipeline is healthy. In the meantime the change was validated locally.

[brsouzapaypal]

Closing this PR — no longer needed.