kryptheon-night 0.1.0

package/intro.js

@@ -0,0 +1,202 @@
+// What the person is asked, and what they are told before anything runs.
+//
+// This file is the whole difference between a tool for people who write code
+// and a tool for people who do not. The engine behind it does not change; the
+// first ninety seconds do.
+//
+// Two things happen here and both are deliberate.
+//
+// Asking, rather than requiring. `KN_DATABASE_URL=... node scan.js public` is
+// three unfamiliar ideas at once: an environment variable, a connection
+// string, and a schema. Somebody who has only ever clicked Deploy has met
+// none of them. So the command takes no arguments, and asks.
+//
+// Telling before doing. This tool connects to a person's production database
+// with the owner's credential and creates things in it. Nobody should agree
+// to that from a package name. What it does, what it does not do, and then a
+// yes or no - in that order, before the first statement is sent.
+
+const readline = require('readline');
+const trouble = require('./trouble.js');
+
+/**
+ * Where the connection string is, said as buttons rather than as concepts.
+ *
+ * Named screen by screen because "get your connection string" is not an
+ * instruction to somebody who does not know the phrase. Supabase first
+ * because that is who this is for; Lovable and Bolt build on Supabase, so
+ * their users end up on the same page by a different door.
+ */
+function whereToFindIt() {
+  return [
+    'Where to find it:',
+    '',
+    '  Supabase   supabase.com/dashboard -> your project -> the gear icon',
+    '             (Project Settings) at the bottom left -> Database ->',
+    '             scroll to "Connection string" -> the URI tab -> Copy.',
+    '',
+    '             Replace [YOUR-PASSWORD] in it with your database password.',
+    '             It is on that same page under "Database password".',
+    '',
+    '  Lovable    your app uses Supabase underneath. Open the Supabase',
+    '  and Bolt   project it made for you and follow the lines above.',
+    '',
+    '  Neon       console.neon.tech -> your project -> Connection Details.',
+    '',
+    'It is one long line beginning postgresql:// and it ends in /postgres.',
+  ];
+}
+
+/**
+ * What is about to happen, and what is not.
+ *
+ * The second half matters more than the first. Everybody who runs this is
+ * being asked to hand a stranger's program the key to their live database,
+ * and the fears they have are specific: will you read my customers, will you
+ * send anything anywhere, will you leave a mess. Each of those is answered in
+ * its own line, in the words they would use.
+ *
+ * Nothing here is a promise made only on this screen. Every line is something
+ * the code is built to make true and a check in this repo fails if it stops
+ * being true - `untouched.check.js` photographs the whole database and
+ * compares it afterwards.
+ */
+function consentLines(target) {
+  return [
+    'Before I touch anything, here is exactly what I am going to do.',
+    '',
+    'What I will do:',
+    '',
+    '  - Look at the shape of your "' + target + '" tables: their names, their',
+    '    columns, and the rules about who is allowed to see what.',
+    '',
+    '  - Make one new temporary space inside your database and rebuild that',
+    '    same shape in it. Your real tables are not changed.',
+    '',
+    '  - Put two made-up people in the copy - fake names, fake emails.',
+    '',
+    '  - Attack the copy. I try to read those two fake people as a stranger',
+    '    would, try to change their rows, try to break them.',
+    '',
+    '  - Tell you what got through, and delete the copy.',
+    '',
+    'What I will not do:',
+    '',
+    '  - I do not read your real data. Not one customer, order or message.',
+    '    Every row I read is a row I put there myself a moment earlier.',
+    '',
+    '  - I do not change your real tables. Only the temporary copy.',
+    '',
+    '  - I do not send anything anywhere. No account, no upload, no server of',
+    '    mine. Your connection string stays on this computer and is not',
+    '    written to any file.',
+    '',
+    '  - I do not leave anything behind. The copy is deleted when I finish,',
+    '    and also if I crash.',
+    '',
+    'This takes two or three minutes.',
+  ];
+}
+
+/** Asks a question and hands back what was typed. */
+function ask(question) {
+  return new Promise((resolve) => {
+    const rl = readline.createInterface({ input: process.stdin, output: process.stdout });
+    rl.question(question, (answer) => {
+      rl.close();
+      resolve(String(answer || '').trim());
+    });
+  });
+}
+
+/**
+ * Asks for something that must not be echoed.
+ *
+ * The connection string carries the password to the entire database. Shown on
+ * screen it is read by whoever is behind them, and it stays in the scrollback
+ * of whatever terminal they are in for as long as that window is open.
+ *
+ * Nothing is printed as they type - not even stars, because a pasted string
+ * of stars is no more checkable than nothing and the character count alone
+ * says how long the password is. What they get instead is the address read
+ * back to them afterwards, with the password removed, which is the part they
+ * would actually want to check.
+ */
+function askSecret(question) {
+  return new Promise((resolve) => {
+    const rl = readline.createInterface({ input: process.stdin, output: process.stdout, terminal: true });
+    let silent = false;
+    // readline writes every keystroke back to the screen itself. This replaces
+    // that with nothing, but only once the prompt has been written - otherwise
+    // the question never appears either.
+    rl._writeToOutput = function (text) {
+      if (!silent) rl.output.write(text);
+    };
+    rl.question(question, (answer) => {
+      silent = false;
+      rl.output.write('\n');
+      rl.close();
+      resolve(String(answer || '').trim());
+    });
+    silent = true;
+  });
+}
+
+/**
+ * Was that a yes?
+ *
+ * The question being answered is "may I connect to your production database",
+ * so the rule is that only a yes is a yes. A stray newline, a shrug, an
+ * accidental Enter on an empty line - none of those are permission, and the
+ * cost of getting this backwards is connecting to somebody's live database
+ * without being asked to.
+ *
+ * Separate from the asking so it can be checked directly. Every form of this
+ * that hid inside a prompt went unchecked.
+ */
+function isYes(answer) {
+  const said = String(answer == null ? '' : answer).trim().toLowerCase();
+  return said === 'y' || said === 'yes';
+}
+
+/** Yes or no, where anything that is not a clear yes is a no. */
+async function askYesNo(question) {
+  return isYes(await ask(question));
+}
+
+/**
+ * The connection string, from wherever it can be had.
+ *
+ * The environment variable is checked first so that anybody scripting this
+ * never sees a prompt, and so the string does not have to be retyped on every
+ * run. Nothing is saved: asked again next time is the correct behaviour for a
+ * credential this powerful, and a file holding it would be the one thing this
+ * tool tells people not to do.
+ */
+async function askForConnection(say) {
+  say('');
+  say('  I need the connection string for your database.');
+  say('');
+  say('  It is one line that lets me connect. It contains your database');
+  say('  password, so I will not show it on screen as you paste it, and I do');
+  say('  not save it anywhere.');
+  say('');
+  whereToFindIt().forEach((l) => say('  ' + l));
+  say('');
+
+  const given = await askSecret('  Paste it here and press Enter: ');
+  return given;
+}
+
+module.exports = {
+  whereToFindIt: whereToFindIt,
+  consentLines: consentLines,
+  ask: ask,
+  askSecret: askSecret,
+  askYesNo: askYesNo,
+  isYes: isYes,
+  askForConnection: askForConnection,
+  // Re-exported so the command has one place to reach for the wording of a
+  // failure, rather than two.
+  withoutSecret: trouble.withoutSecret,
+};

package/orphan.js

@@ -0,0 +1,230 @@
+// The interruption attack: can a half-finished write survive?
+//
+// A request cut off partway is mostly a question about the app's code - were
+// the two inserts wrapped in a transaction? - and this tool never sees the
+// app's code. Guessing would be the lost update all over again.
+//
+// But there is a half of it the database answers on its own. A foreign key is
+// what makes a half-finished state impossible to keep, no matter how badly the
+// app behaves or where the connection drops. Without one, an order can name a
+// customer who does not exist, and nothing will ever notice.
+//
+// So the attack is: put in a row pointing at something that is not there, and
+// see whether the database takes it.
+//
+// WHAT THAT ACTUALLY COSTS SOMEBODY (measured in probe-orphan.js)
+//
+//   - with no foreign key the row is accepted, and nothing in the database
+//     will ever find it again
+//   - with one, the insert is refused
+//   - with one, deleting the parent is refused too - so "delete my account"
+//     really does take the data with it, or fails loudly. Without one, the
+//     customer is gone and their rows are still sitting there.
+//
+// WHAT IS DELIBERATELY NOT REPORTED
+//
+// A column with no table it could point at. `stripe_id`, `session_id`,
+// `external_id` reference something outside this database entirely, and
+// telling somebody to add a foreign key to one would be telling them to break
+// their app. Only a column whose name matches a real table here, whose type
+// matches that table's key, is ever considered.
+//
+// Log and audit tables are left alone too. Keeping the id of something that
+// has since been deleted is the entire point of an audit row, and a foreign
+// key there would be the bug.
+
+const { quote } = require('./schema.js');
+const attack = require('./attack.js');
+
+// Tables whose job is to remember things after they are gone. A dangling id in
+// an audit row is the feature.
+const KEEPS_HISTORY = /(^|_)(log|logs|audit|audits|event|events|history|archive|archives|snapshot|snapshots|activity|activities)(_|$)/i;
+
+/** The single-column primary key of a table, or null if it has none. */
+function primaryKeyOf(table) {
+  for (const constraint of table.constraints || []) {
+    if (constraint.kind !== 'p') continue;
+    const match = /PRIMARY KEY \(([^)]+)\)/i.exec(constraint.definition);
+    if (!match) continue;
+    const columns = match[1].split(',').map((name) => name.trim().split('"').join(''));
+    // A composite key is not something a single `<thing>_id` column points at.
+    return columns.length === 1 ? columns[0] : null;
+  }
+  return null;
+}
+
+/**
+ * The table a column named `<thing>_id` is pointing at, if there is one.
+ *
+ * The name has to match a table that is really here, and the types have to
+ * agree. Both, because `stripe_id` matches nothing and `org_id integer` does
+ * not point at an `orgs.id` that is a uuid.
+ */
+function parentFor(column, tables) {
+  const stem = /^(.+)_id$/i.exec(column.name);
+  if (!stem) return null;
+  const wanted = stem[1].toLowerCase();
+  const parent = (tables || []).find((table) => {
+    const name = table.name.toLowerCase();
+    return name === wanted || name === wanted + 's' || name === wanted + 'es';
+  });
+  if (!parent) return null;
+
+  const key = primaryKeyOf(parent);
+  if (!key) return null;
+  const keyColumn = (parent.columns || []).find((c) => c.name === key);
+  if (!keyColumn || keyColumn.type !== column.type) return null;
+
+  return { table: parent, keyColumn: key, type: keyColumn.type };
+}
+
+/** Is this column already held down by a foreign key? */
+function alreadyTied(table, columnName) {
+  return attack.foreignKeys(table).some((key) => key.columns.includes(columnName));
+}
+
+/**
+ * Every column that looks like it points somewhere, with whether it is already
+ * tied down.
+ *
+ * Tied columns are attacked too, the same way the collision attack races
+ * columns that already have a unique index. Skipping them would mean that the
+ * moment somebody adds the foreign key this asked for, the attack stops
+ * running - and the re-check could no longer watch it be refused, so it would
+ * report the fix it requested as "could not confirm".
+ *
+ * `tied` decides what is reported, never what is attempted.
+ */
+function candidates(tables) {
+  const found = [];
+  for (const table of tables || []) {
+    if (KEEPS_HISTORY.test(table.name)) continue;
+    for (const column of table.columns || []) {
+      const parent = parentFor(column, tables);
+      if (!parent) continue;
+      found.push({
+        table: table.name,
+        column: column.name,
+        parent: parent.table.name,
+        parentKey: parent.keyColumn,
+        type: parent.type,
+        tied: alreadyTied(table, column.name),
+      });
+    }
+  }
+  return found;
+}
+
+/** A value of the right type that is certainly not in the parent table. */
+function nobody(type) {
+  const kind = String(type).toLowerCase();
+  if (kind === 'uuid') return '99999999-9999-4999-8999-999999999999';
+  if (/^(integer|bigint|smallint)/.test(kind)) return 2147480000;
+  if (/^(numeric|decimal|real|double)/.test(kind)) return 2147480000;
+  return 'kryptheon-nobody';
+}
+
+/**
+ * Point a row at something that is not there, and see if it is taken.
+ *
+ * Run as the owner of the schema on purpose. The question is not who is
+ * allowed to create an orphan - it is whether the database permits one to
+ * exist at all, which is what decides whether a dropped connection can leave
+ * one behind.
+ *
+ * Rolled back, always. Nothing this does survives the statement that did it.
+ */
+async function orphan(client, schema, tables, seeded) {
+  const findings = [];
+  const completed = [];
+  const notTried = [];
+  const shapeFor = new Map((seeded || []).map((entry) => [entry.table, entry.attempt || 0]));
+  const byName = new Map((tables || []).map((table) => [table.name, table]));
+
+  for (const target of candidates(tables)) {
+    const key = 'orphaned:' + target.table + ':' + target.column;
+    const table = byName.get(target.table);
+    const missing = nobody(target.type);
+
+    // It only proves anything if the value really is absent from the parent.
+    try {
+      const { rows } = await client.query(
+        'SELECT 1 FROM ' + quote(schema) + '.' + quote(target.parent) +
+          ' WHERE ' + quote(target.parentKey) + ' = $1 LIMIT 1',
+        [missing],
+      );
+      if (rows.length) {
+        notTried.push({ table: target.table, column: target.column, why: 'the test value was already in ' + target.parent });
+        continue;
+      }
+    } catch (err) {
+      notTried.push({ table: target.table, column: target.column, why: 'could not look in ' + target.parent + ': ' + err.message });
+      continue;
+    }
+
+    const override = {};
+    override[target.column] = missing;
+    let row;
+    try {
+      row = await attack.rowFor(client, schema, table, attack.USER_C, 9, override, shapeFor.get(target.table));
+    } catch (err) {
+      notTried.push({ table: target.table, column: target.column, why: err.message });
+      continue;
+    }
+
+    await client.query('BEGIN');
+    let landed = false;
+    let refused = null;
+    try {
+      await client.query("SET LOCAL statement_timeout = '15s'");
+      await attack.insertRow(client, schema, target.table, row);
+      landed = true;
+    } catch (err) {
+      refused = err.message;
+    } finally {
+      await client.query('ROLLBACK').catch(() => {});
+    }
+
+    if (!landed && !/violates foreign key constraint/i.test(String(refused))) {
+      // Turned away by something other than referential integrity, so nothing
+      // was learned about whether an orphan can exist.
+      notTried.push({ table: target.table, column: target.column, why: refused });
+      continue;
+    }
+
+    completed.push(key);
+    // Whether a key is supposedly there does not come into it. What is reported
+    // is what landed.
+    //
+    // There was a `&& !target.tied` here, on the reasoning that a tied column
+    // could not produce an orphan anyway. It could not - measured on Neon, a
+    // foreign key cannot be quietly switched off: DISABLE TRIGGER ALL is
+    // refused because the constraint triggers are system triggers, and DISABLE
+    // TRIGGER USER does not touch them. So the guard never fired, and a guard
+    // that never fires is one more thing that can be wrong. If a row naming
+    // nobody ever does land on a column with a key on it, that is worse news
+    // than usual and saying so is right.
+    if (landed) {
+      findings.push({
+        kind: 'orphaned',
+        table: target.table,
+        column: target.column,
+        parent: target.parent,
+        parentKey: target.parentKey,
+        columns: (table.columns || []).map((c) => c.name),
+      });
+    }
+  }
+
+  return { findings: findings, completed: completed, notTried: notTried };
+}
+
+module.exports = {
+  KEEPS_HISTORY: KEEPS_HISTORY,
+  primaryKeyOf: primaryKeyOf,
+  parentFor: parentFor,
+  alreadyTied: alreadyTied,
+  candidates: candidates,
+  nobody: nobody,
+  orphan: orphan,
+};

package/package.json

@@ -0,0 +1,73 @@
+{
+  "name": "kryptheon-night",
+  "version": "0.1.0",
+  "description": "Attacks a copy of your Supabase database and tells you in plain English what got in.",
+  "license": "MIT",
+  "type": "commonjs",
+  "bin": {
+    "kryptheon-night": "bin/kryptheon-night.js"
+  },
+  "files": [
+    "bin/",
+    "scan.js",
+    "schema.js",
+    "attack.js",
+    "finding.js",
+    "collision.js",
+    "tamper.js",
+    "orphan.js",
+    "recheck.js",
+    "intro.js",
+    "trouble.js",
+    "connect.js",
+    "README.md"
+  ],
+  "engines": {
+    "node": ">=18.0.0"
+  },
+  "scripts": {
+    "check": "node package.check.js && node trouble.check.js && node intro.check.js && node finding.check.js && node recheck.check.js && node untouched.check.js && node blocked.check.js && node orphans.check.js && node guests.check.js && node usable.check.js && node twin.check.js && node external.check.js && node schema.check.js && node collision.check.js && node tamper.check.js && node orphan.check.js && node shapes.check.js && node verdicts.check.js && node loop.check.js",
+    "check:dry": "node package.check.js && node trouble.check.js && node intro.check.js && node finding.check.js && node recheck.check.js",
+    "check:package": "node package.check.js",
+    "check:trouble": "node trouble.check.js",
+    "check:intro": "node intro.check.js",
+    "check:report": "node finding.check.js",
+    "check:recheck": "node recheck.check.js",
+    "check:copy": "node schema.check.js",
+    "check:collision": "node collision.check.js",
+    "check:loop": "node loop.check.js",
+    "probe": "node probe-rls.js",
+    "probe:collision": "node probe-collision.js",
+    "demo": "node demo.js",
+    "check:promise": "node untouched.check.js",
+    "check:blocked": "node blocked.check.js",
+    "check:external": "node external.check.js",
+    "check:shapes": "node shapes.check.js",
+    "check:verdicts": "node verdicts.check.js",
+    "check:writes": "node tamper.check.js",
+    "check:orphans": "node orphans.check.js",
+    "probe:write": "node probe-write.js",
+    "check:usable": "node usable.check.js",
+    "check:guests": "node guests.check.js",
+    "check:interruption": "node orphan.check.js",
+    "probe:orphan": "node probe-orphan.js",
+    "check:twin": "node twin.check.js",
+    "prepublishOnly": "node package.check.js"
+  },
+  "keywords": [
+    "supabase",
+    "postgres",
+    "rls",
+    "row-level-security",
+    "security",
+    "lovable",
+    "cli"
+  ],
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/jhashantanu987-beep/kryptheon-night.git"
+  },
+  "dependencies": {
+    "pg": "^8.23.0"
+  }
+}