kryptheon-night 0.1.0 → 0.1.2

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "kryptheon-night",
-  "version": "0.1.0",
+  "version": "0.1.2",
   "description": "Attacks a copy of your Supabase database and tells you in plain English what got in.",
   "license": "MIT",
   "type": "commonjs",

package/schema.js

@@ -499,6 +499,44 @@ function rewriteSchemaRefs(expr, fromSchema, toSchema) {
   return String(expr).split(quote(fromSchema) + '.').join(quote(toSchema) + '.').split(fromSchema + '.').join(toSchema + '.');
 }
 
+/**
+ * Points a reference with no schema on it at the copy.
+ *
+ * The one the other two rewrites could not see. `pg_get_constraintdef` writes
+ * the schema only when the referenced table is *not* reachable through
+ * `search_path` - so an app living in `app_something` comes back as
+ * "REFERENCES app_something.profiles(id)" and is rewritten, while the same app
+ * living in `public` comes back as "REFERENCES profiles(id)" and there is
+ * nothing to rewrite. Replayed into the copy, that bare name resolves through
+ * `search_path` all over again, and binds to the customer's real table.
+ *
+ * Found on the first real Supabase project this was ever pointed at, which is
+ * the first app that was not in a schema of its own:
+ *
+ *   notes_owner_fkey     -> public.profiles      (the customer's own table)
+ *   orders_user_id_fkey  -> public.profiles      (the customer's own table)
+ *
+ * Nothing was written to those tables - the copy only pointed at them - but
+ * the copy was not the app, which is the same failure three other bugs in this
+ * file were. Here it meant every insert into the copy was checked against a
+ * table the seeder had put nothing in, so two tables out of four were never
+ * attacked and were reported, honestly but uselessly, as not checked.
+ *
+ * Only names the plan itself owns are touched. A reference to something
+ * outside the schema is the stand-in's business, not this one's.
+ */
+function qualifyOwnRefs(definition, plan, target) {
+  const own = new Set((plan.tables || []).map((table) => table.name));
+  // A replacer function, never a replacement string: `$&` and friends are read
+  // as instructions inside one, and that has already cost this project an
+  // engine that would not install.
+  return String(definition).replace(
+    /(\bREFERENCES\s+)("?)([^".\s(]+)\2(\s*\()/gi,
+    (whole, before, quoteMark, name, after) =>
+      (own.has(name) ? before + quote(target) + '.' + quote(name) + after : whole),
+  );
+}
+
 /**
  * Points a foreign key at the stand-in instead of at the real outside table.
  *
@@ -669,9 +707,13 @@ async function writeSchema(client, plan, target) {
       for (const constraint of table.constraints) {
         const isForeign = constraint.kind === 'f';
         if (isForeign !== wantForeign) continue;
-        const definition = rewriteExternalRefs(
-          rewriteSchemaRefs(constraint.definition, plan.schema, target),
-          plan.external,
+        const definition = qualifyOwnRefs(
+          rewriteExternalRefs(
+            rewriteSchemaRefs(constraint.definition, plan.schema, target),
+            plan.external,
+            target,
+          ),
+          plan,
           target,
         );
         statements.push(
@@ -770,6 +812,36 @@ async function writeSchema(client, plan, target) {
   for (const statement of statements) {
     await client.query(statement);
   }
+
+  // And then look at what was actually built, rather than at what was meant.
+  //
+  // Everything above this line reasons about strings. The guard at the top of
+  // this file reads the statements before they run; this one asks Postgres
+  // where the copy ended up pointing, which is the only account of it that
+  // cannot be fooled by a spelling nobody anticipated - and one was not. A
+  // bare "REFERENCES profiles(id)" replayed into the copy bound to the
+  // customer's own table, silently, on every app that lives in `public`.
+  //
+  // Nothing is written to a table outside the copy either way. The damage is
+  // subtler than that: a copy tied to the customer's rows is not the app being
+  // attacked, and every verdict taken from it is about something else.
+  const { rows: strays } = await client.query(
+    `SELECT con.conname, rn.nspname AS points_at
+       FROM pg_constraint con
+       JOIN pg_class cl ON cl.oid = con.conrelid
+       JOIN pg_namespace cn ON cn.oid = cl.relnamespace
+       JOIN pg_class rc ON rc.oid = con.confrelid
+       JOIN pg_namespace rn ON rn.oid = rc.relnamespace
+      WHERE con.contype = 'f' AND cn.nspname = $1 AND rn.nspname <> $1`,
+    [target],
+  );
+  if (strays.length) {
+    throw new Error(
+      'the copy points outside itself, so it is not the app: ' +
+        strays.map((row) => row.conname + ' -> ' + row.points_at).join(', '),
+    );
+  }
+
   return statements;
 }
 

package/trouble.js

@@ -314,6 +314,34 @@ const BY_SYSCALL = {
   ],
 };
 
+/**
+ * Is this Supabase's direct connection, and if so whose?
+ *
+ * `db.<ref>.supabase.co` is the direct connection. Supabase stopped giving it
+ * an IPv4 address, so today it resolves to an AAAA record and nothing else -
+ * and on a machine with no IPv6 the name does not resolve at all. The failure
+ * that produces is ENOTFOUND: not "unreachable", which would at least hint at
+ * the network, but "no such name", which reads as a typo.
+ *
+ * Measured on a real project: A = ENODATA, AAAA = 2406:da1c:..., and no
+ * global IPv6 on the machine. The scan said "there is a typo in the address,
+ * or this computer is not online... if your project was paused or deleted",
+ * and all three of those were false. That sends somebody to reset a password
+ * or rebuild a project that was never broken.
+ *
+ * The ref is handed back so the pooler string can be spelled out with their
+ * own project in it rather than as a shape to fill in.
+ */
+function supabaseDirectRef(raw) {
+  try {
+    const host = new URL(String(raw).trim().replace(/^["']|["']$/g, '')).hostname;
+    const match = /^db\.([a-z0-9]+)\.supabase\.(co|com)$/i.exec(host);
+    return match ? match[1] : null;
+  } catch (err) {
+    return null;
+  }
+}
+
 /**
  * One failure, in plain English.
  *
@@ -326,6 +354,33 @@ const BY_SYSCALL = {
 function explain(err, raw) {
   const code = err && err.code ? String(err.code) : '';
 
+  // Checked before the general ENOTFOUND, because for this one address the
+  // general answer is wrong in every one of its three guesses.
+  const ref = code === 'ENOTFOUND' ? supabaseDirectRef(raw) : null;
+  if (ref) {
+    return [
+      'I could not find that server - and I think I know why.',
+      '',
+      'That address is Supabase’s direct connection, and it now answers only',
+      'over IPv6. Plenty of home and office networks have no IPv6 at all, and on',
+      'those the name does not resolve to anything - which is what just',
+      'happened here.',
+      '',
+      'There is nothing wrong with your project or your password. Use the',
+      'session pooler instead, which answers over the ordinary internet:',
+      '',
+      '  Supabase dashboard -> Project Settings -> Database ->',
+      '  Connection string -> URI -> and pick "Session pooler".',
+      '',
+      'It looks like this, with your password in the middle:',
+      '',
+      '  postgresql://postgres.' + ref + ':PASSWORD@aws-0-REGION.pooler.supabase.com:5432/postgres',
+      '',
+      'Take the port 5432 one. The other pooler, on 6543, hands every statement',
+      'a different connection and these attacks have to stay on one.',
+    ];
+  }
+
   if (BY_CODE[code]) return BY_CODE[code].slice();
   if (BY_SYSCALL[code]) return BY_SYSCALL[code].slice();
 
@@ -372,6 +427,7 @@ module.exports = {
   readConnectionString: readConnectionString,
   poolerWarning: poolerWarning,
   explain: explain,
+  supabaseDirectRef: supabaseDirectRef,
   withoutSecret: withoutSecret,
   PLACEHOLDERS: PLACEHOLDERS,
 };