kryptheon-night 0.1.1 → 0.1.3

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "kryptheon-night",
-  "version": "0.1.1",
+  "version": "0.1.3",
   "description": "Attacks a copy of your Supabase database and tells you in plain English what got in.",
   "license": "MIT",
   "type": "commonjs",

package/schema.js

@@ -499,6 +499,57 @@ function rewriteSchemaRefs(expr, fromSchema, toSchema) {
   return String(expr).split(quote(fromSchema) + '.').join(quote(toSchema) + '.').split(fromSchema + '.').join(toSchema + '.');
 }
 
+/**
+ * Points a reference with no schema on it at the copy.
+ *
+ * The one the other two rewrites could not see. `pg_get_constraintdef` writes
+ * the schema only when the referenced table is *not* reachable through
+ * `search_path` - so an app living in `app_something` comes back as
+ * "REFERENCES app_something.profiles(id)" and is rewritten, while the same app
+ * living in `public` comes back as "REFERENCES profiles(id)" and there is
+ * nothing to rewrite. Replayed into the copy, that bare name resolves through
+ * `search_path` all over again, and binds to the customer's real table.
+ *
+ * Found on the first real Supabase project this was ever pointed at, which is
+ * the first app that was not in a schema of its own:
+ *
+ *   notes_owner_fkey     -> public.profiles      (the customer's own table)
+ *   orders_user_id_fkey  -> public.profiles      (the customer's own table)
+ *
+ * Nothing was written to those tables - the copy only pointed at them - but
+ * the copy was not the app, which is the same failure three other bugs in this
+ * file were. Here it meant every insert into the copy was checked against a
+ * table the seeder had put nothing in, so two tables out of four were never
+ * attacked and were reported, honestly but uselessly, as not checked.
+ *
+ * Only names the plan itself owns are touched. A reference to something
+ * outside the schema is the stand-in's business, not this one's.
+ */
+function qualifyOwnRefs(definition, plan, target) {
+  const own = new Set((plan.tables || []).map((table) => table.name));
+  // A replacer function, never a replacement string: `$&` and friends are read
+  // as instructions inside one, and that has already cost this project an
+  // engine that would not install.
+  // A quoted identifier can hold anything, including spaces and quotes of its
+  // own doubled up, so it is matched as a whole rather than as a run of safe
+  // characters. The first attempt used [^".\s(]+ inside the quotes and
+  // silently did not match `REFERENCES "Group Table"(...)` - which the twin
+  // fixture has, because it was built out of every shape that has ever been
+  // read wrong, and it caught this the first time it ran.
+  //
+  // The unquoted alternative excludes a dot, so a name that is already
+  // schema-qualified is left alone: that is the other rewrite's work.
+  return String(definition).replace(
+    /(\bREFERENCES\s+)("(?:[^"]|"")*"|[^\s(".]+)(\s*\()/gi,
+    (whole, before, written, after) => {
+      const name = written.charAt(0) === '"'
+        ? written.slice(1, -1).split('""').join('"')
+        : written;
+      return own.has(name) ? before + quote(target) + '.' + quote(name) + after : whole;
+    },
+  );
+}
+
 /**
  * Points a foreign key at the stand-in instead of at the real outside table.
  *
@@ -669,9 +720,13 @@ async function writeSchema(client, plan, target) {
       for (const constraint of table.constraints) {
         const isForeign = constraint.kind === 'f';
         if (isForeign !== wantForeign) continue;
-        const definition = rewriteExternalRefs(
-          rewriteSchemaRefs(constraint.definition, plan.schema, target),
-          plan.external,
+        const definition = qualifyOwnRefs(
+          rewriteExternalRefs(
+            rewriteSchemaRefs(constraint.definition, plan.schema, target),
+            plan.external,
+            target,
+          ),
+          plan,
           target,
         );
         statements.push(
@@ -767,9 +822,89 @@ async function writeSchema(client, plan, target) {
   }
 
   mustStayInside(statements, target);
-  for (const statement of statements) {
-    await client.query(statement);
+  // Built with the copy first on the search_path, so a bare name binds to the
+  // copy and not to whatever the customer happens to have.
+  //
+  // This is the structural half, and it went in after chasing the same bug
+  // through three different kinds of expression. Postgres writes a name
+  // without its schema whenever that name is already reachable - so a real app
+  // in `public` hands back "REFERENCES profiles(id)" and
+  // "nextval('orders_id_seq'::regclass)", and a rewrite that goes looking for
+  // a schema name finds nothing to change in either. Replayed into the copy,
+  // both bound to the customer's own objects: the foreign keys pointed at
+  // their tables, and the copy drew its keys from their sequences, which
+  // advanced them.
+  //
+  // Rewriting each kind of expression in turn is a game with no end - index
+  // predicates, checks that call a function, view bodies. Naming the copy
+  // first on the path ends all of them at once, because it changes what a
+  // bare name means rather than trying to find every place one can appear.
+  //
+  // `public` stays on the path, after the copy, because the copy legitimately
+  // needs what lives there - gen_random_uuid() and the like. `extensions` is
+  // where Supabase keeps them; a schema on the path that does not exist is
+  // ignored rather than an error.
+  const { rows: pathRows } = await client.query('SHOW search_path');
+  const restoreTo = pathRows[0].search_path;
+  await client.query('SET search_path TO ' + quote(target) + ', public, extensions');
+  try {
+    for (const statement of statements) {
+      await client.query(statement);
+    }
+  } finally {
+    await client.query('SET search_path TO ' + restoreTo).catch(() => {});
   }
+
+  // And then look at what was actually built, rather than at what was meant.
+  //
+  // Everything above this line reasons about strings. The guard at the top of
+  // this file reads the statements before they run; this one asks Postgres
+  // where the copy ended up pointing, which is the only account of it that
+  // cannot be fooled by a spelling nobody anticipated - and one was not. A
+  // bare "REFERENCES profiles(id)" replayed into the copy bound to the
+  // customer's own table, silently, on every app that lives in `public`.
+  //
+  // Nothing is written to a table outside the copy either way. The damage is
+  // subtler than that: a copy tied to the customer's rows is not the app being
+  // attacked, and every verdict taken from it is about something else.
+  // Foreign keys AND column defaults, because the second one is where this
+  // hid after the first was closed: a serial column's default is
+  // nextval('<sequence>'), and the copy was calling the customer's. Nothing
+  // was written to their tables, but nextval advances a sequence, so their
+  // database changed - and "we never touch your live app" says at all.
+  //
+  // Asked of pg_depend rather than of the text, so it holds for any
+  // expression that ends up pointing at a relation, not only the ones anybody
+  // thought to look at. pg_catalog is excluded because everything depends on
+  // it; anything else outside the copy is the bug.
+  const { rows: strays } = await client.query(
+    `SELECT con.conname AS what, rn.nspname AS points_at
+       FROM pg_constraint con
+       JOIN pg_class cl ON cl.oid = con.conrelid
+       JOIN pg_namespace cn ON cn.oid = cl.relnamespace
+       JOIN pg_class rc ON rc.oid = con.confrelid
+       JOIN pg_namespace rn ON rn.oid = rc.relnamespace
+      WHERE con.contype = 'f' AND cn.nspname = $1 AND rn.nspname <> $1
+      UNION ALL
+     SELECT cl.relname || '.' || a.attname || ' default' AS what,
+            rn.nspname || '.' || rc.relname AS points_at
+       FROM pg_depend d
+       JOIN pg_attrdef ad ON ad.oid = d.objid AND d.classid = 'pg_attrdef'::regclass
+       JOIN pg_class cl ON cl.oid = ad.adrelid
+       JOIN pg_namespace cn ON cn.oid = cl.relnamespace
+       JOIN pg_attribute a ON a.attrelid = ad.adrelid AND a.attnum = ad.adnum
+       JOIN pg_class rc ON rc.oid = d.refobjid AND d.refclassid = 'pg_class'::regclass
+       JOIN pg_namespace rn ON rn.oid = rc.relnamespace
+      WHERE cn.nspname = $1 AND rn.nspname <> $1 AND rn.nspname <> 'pg_catalog'`,
+    [target],
+  );
+  if (strays.length) {
+    throw new Error(
+      'the copy points outside itself, so it is not the app: ' +
+        strays.map((row) => row.what + ' -> ' + row.points_at).join(', '),
+    );
+  }
+
   return statements;
 }
 
@@ -915,6 +1050,7 @@ module.exports = {
   readExternalTargets: readExternalTargets,
   referenceIn: referenceIn,
   rewriteSchemaRefs: rewriteSchemaRefs,
+  qualifyOwnRefs: qualifyOwnRefs,
   stubNameFor: stubNameFor,
   IDENTITIES: IDENTITIES,
   quote: quote,