kryptheon-night 0.1.22 → 0.1.25

package/finding.js

@@ -291,6 +291,17 @@ function causeOf(finding) {
 /** What a caller could do, written the way a person would say it. */
 const WRITE_WORDS = { add: 'add rows to', change: 'change rows in', delete: 'delete rows from' };
 
+/**
+ * The error a looping rule produces, as Postgres words it. A rule that reads
+ * its own table directly is caught as recursion and named; one that reaches
+ * it through a helper function runs out of stack, and Postgres names nothing.
+ */
+function loopError(finding) {
+  return finding.deep
+    ? '"stack depth limit exceeded"'
+    : '"infinite recursion detected in policy for relation ' + finding.table + '"';
+}
+
 /** Who a looping rule fails for, said the way the headline and body need it. */
 function loopVictims(finding) {
   const callers = finding.callers || [];
@@ -363,8 +374,9 @@ function bodyFor(finding, contents) {
     const one = reads.length === 1;
     return (
       'Using ' + listOf(reads) + ' on a copy of your app as ' + as.join(' and as ') +
-      ', every request was refused with "infinite recursion detected in policy for relation ' +
-      finding.table + '". Every page in your app that uses ' + (one ? 'that table' : 'those tables') +
+      ', every request was refused with ' + loopError(finding) +
+      (finding.deep ? ' - a rule on ' + finding.table + ' calls a helper that reads ' + finding.table + ' again, which runs the rule again' : '') +
+      '. Every page in your app that uses ' + (one ? 'that table' : 'those tables') +
       ' fails the same way for ' + loopVictims(finding).replace(/,$/, '') + '. It also means I could ' +
       'not test ' + (one ? 'it' : 'them') + ' for leaks - those attacks are listed at the end.'
     );
@@ -662,8 +674,8 @@ function fixPromptFor(finding) {
       'My app has a broken database rule.',
       '',
       'A row level security policy on the "' + finding.table + '" table reads "' + finding.table +
-        '" itself, so Postgres stops every request that touches it with "infinite recursion ' +
-        'detected in policy for relation ' + finding.table + '". I saw it when using ' +
+        '" itself' + (finding.deep ? ', through a helper function it calls,' : '') +
+        ' so Postgres stops every request that touches it with ' + loopError(finding) + '. I saw it when using ' +
         listOf((finding.reads || []).map((t) => '"' + t + '"')) + '.',
       '',
       'Show me the policies on "' + finding.table + '" and on every table whose policy reads "' +
@@ -885,7 +897,7 @@ function describe(finding) {
     can: finding.can,
     proof: finding.kind === 'recursive'
       ? 'Using ' + listOf((finding.reads || []).map((t) => '"' + t + '"')) + ' stopped with ' +
-        '"infinite recursion detected in policy for relation ' + finding.table + '".'
+        loopError(finding) + '.'
       : finding.kind === 'privileged'
       ? 'I did not call "' + finding.fn + '". This is a reach that exists in the grants, not a break I ran.'
       : finding.kind === 'duplicated'

package/orphan.js

@@ -40,43 +40,11 @@ const attack = require('./attack.js');
 // an audit row is the feature.
 const KEEPS_HISTORY = /(^|_)(log|logs|audit|audits|event|events|history|archive|archives|snapshot|snapshots|activity|activities)(_|$)/i;
 
-/** The single-column primary key of a table, or null if it has none. */
-function primaryKeyOf(table) {
-  for (const constraint of table.constraints || []) {
-    if (constraint.kind !== 'p') continue;
-    const match = /PRIMARY KEY \(([^)]+)\)/i.exec(constraint.definition);
-    if (!match) continue;
-    const columns = match[1].split(',').map((name) => name.trim().split('"').join(''));
-    // A composite key is not something a single `<thing>_id` column points at.
-    return columns.length === 1 ? columns[0] : null;
-  }
-  return null;
-}
-
-/**
- * The table a column named `<thing>_id` is pointing at, if there is one.
- *
- * The name has to match a table that is really here, and the types have to
- * agree. Both, because `stripe_id` matches nothing and `org_id integer` does
- * not point at an `orgs.id` that is a uuid.
- */
-function parentFor(column, tables) {
-  const stem = /^(.+)_id$/i.exec(column.name);
-  if (!stem) return null;
-  const wanted = stem[1].toLowerCase();
-  const parent = (tables || []).find((table) => {
-    const name = table.name.toLowerCase();
-    return name === wanted || name === wanted + 's' || name === wanted + 'es';
-  });
-  if (!parent) return null;
-
-  const key = primaryKeyOf(parent);
-  if (!key) return null;
-  const keyColumn = (parent.columns || []).find((c) => c.name === key);
-  if (!keyColumn || keyColumn.type !== column.type) return null;
-
-  return { table: parent, keyColumn: key, type: keyColumn.type };
-}
+// Which table a `<thing>_id` column points at is decided in attack.js, because
+// the seeder needs the same answer: a row has to point at a parent that is
+// really there, whether or not a key says so.
+const primaryKeyOf = attack.primaryKeyOf;
+const parentFor = attack.parentFor;
 
 /** Is this column already held down by a foreign key? */
 function alreadyTied(table, columnName) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "kryptheon-night",
-  "version": "0.1.22",
+  "version": "0.1.25",
   "description": "Attacks a copy of your Supabase database and tells you in plain English what got in.",
   "license": "MIT",
   "type": "commonjs",
@@ -31,7 +31,7 @@
     "node": ">=18.0.0"
   },
   "scripts": {
-    "check": "node package.check.js && node store.check.js && node trouble.check.js && node intro.check.js && node finding.check.js && node outside.check.js && node recheck.check.js && node untouched.check.js && node blocked.check.js && node orphans.check.js && node guests.check.js && node usable.check.js && node twin.check.js && node engines.check.js && node external.check.js && node schema.check.js && node collision.check.js && node tamper.check.js && node orphan.check.js && node shapes.check.js && node verdicts.check.js && node shop.check.js && node privileged.check.js && node recursion.check.js && node guarded.check.js && node nightly.check.js && node words.check.js && node cli.check.js && node loop.check.js",
+    "check": "node package.check.js && node store.check.js && node trouble.check.js && node intro.check.js && node finding.check.js && node outside.check.js && node recheck.check.js && node untouched.check.js && node blocked.check.js && node orphans.check.js && node guests.check.js && node usable.check.js && node twin.check.js && node engines.check.js && node external.check.js && node schema.check.js && node collision.check.js && node tamper.check.js && node orphan.check.js && node shapes.check.js && node verdicts.check.js && node shop.check.js && node privileged.check.js && node recursion.check.js && node guarded.check.js && node nightly.check.js && node words.check.js && node helpers.check.js && node deeploop.check.js && node teams.check.js && node cli.check.js && node loop.check.js",
     "check:dry": "node package.check.js && node store.check.js && node trouble.check.js && node intro.check.js && node finding.check.js && node recheck.check.js && node outside.check.js",
     "check:package": "node package.check.js",
     "check:store": "node store.check.js",
@@ -57,6 +57,9 @@
     "check:guarded": "node guarded.check.js",
     "check:nightly": "node nightly.check.js",
     "check:words": "node words.check.js",
+    "check:helpers": "node helpers.check.js",
+    "check:deeploop": "node deeploop.check.js",
+    "check:teams": "node teams.check.js",
     "check:cli": "node cli.check.js",
     "check:writes": "node tamper.check.js",
     "check:orphans": "node orphans.check.js",

package/scan.js

@@ -320,16 +320,24 @@ async function scan(client, sourceSchema, options) {
     // app is broken for the people using it. One finding per table at fault,
     // named from Postgres's own message, however many reads ran into it.
     const loops = new Map();
+    // A loop that named no table ("stack depth limit exceeded") is put on the
+    // tables whose own rule calls a helper that reads that same table; if
+    // none can be found, on the table that was being read.
+    const culprits = loopingTables(copyPlan);
     const loopedInto = (relation, table, who) => {
-      if (!loops.has(relation)) loops.set(relation, { kind: 'recursive', table: relation, reads: [], callers: [], columns: [] });
-      const entry = loops.get(relation);
-      if (!entry.reads.includes(table)) entry.reads.push(table);
-      if (!entry.callers.includes(who)) entry.callers.push(who);
+      const deep = !relation;
+      for (const at of relation ? [relation] : culprits.length ? culprits : [table]) {
+        if (!loops.has(at)) loops.set(at, { kind: 'recursive', table: at, reads: [], callers: [], columns: [], deep: false });
+        const entry = loops.get(at);
+        if (deep) entry.deep = true;
+        if (!entry.reads.includes(table)) entry.reads.push(table);
+        if (!entry.callers.includes(who)) entry.callers.push(who);
+      }
     };
     for (const hit of impersonation.looped || []) loopedInto(hit.relation, hit.table, hit.who);
     for (const stuck of writes.blocked) {
       const relation = attack.recursionIn(stuck.why);
-      if (relation) loopedInto(relation, stuck.table, /^as anyone:/.test(stuck.why) ? 'anyone' : 'signed-in');
+      if (relation || attack.tooDeep(stuck.why)) loopedInto(relation || null, stuck.table, /^as anyone:/.test(stuck.why) ? 'anyone' : 'signed-in');
     }
     const recursive = Array.from(loops.values());
 
@@ -422,6 +430,36 @@ function exitCodeFor(result) {
   return (result.findings || []).some((f) => f.status !== 'verification required') ? 1 : 0;
 }
 
+/**
+ * The tables whose own rule reaches back into the same table through the
+ * helpers it calls - directly or through helpers those call. Such a rule has
+ * to be evaluated to be evaluated, which is how "stack depth limit exceeded"
+ * happens; the message itself does not say which table.
+ */
+function loopingTables(plan) {
+  const escape = (x) => x.replace(/[.*+?^${}()|[\]\\]/g, '\\$&');
+  const calls = (text, name) => new RegExp('(^|[^A-Za-z0-9_$])"?' + escape(name) + '"?\\s*\\(').test(String(text || ''));
+  const mentions = (text, name) => new RegExp('(^|[^A-Za-z0-9_$])"?' + escape(name) + '"?([^A-Za-z0-9_$]|$)').test(String(text || ''));
+  const fns = (plan && plan.functions) || [];
+  const reached = (text) => {
+    const found = new Set(fns.filter((f) => calls(text, f.name)).map((f) => f.name));
+    let grew = true;
+    while (grew) {
+      grew = false;
+      for (const f of fns) {
+        if (found.has(f.name)) continue;
+        if (fns.some((g) => found.has(g.name) && calls(g.src, f.name))) { found.add(f.name); grew = true; }
+      }
+    }
+    return fns.filter((f) => found.has(f.name));
+  };
+  return ((plan && plan.tables) || []).map((t) => t.name).filter((name) => {
+    const rules = ((plan && plan.policies) || []).filter((p) => p.table_name === name)
+      .map((p) => String(p.qual || '') + ' ' + String(p.with_check || '')).join(' ');
+    return rules.trim() && reached(rules).some((f) => mentions(f.src, name));
+  });
+}
+
 /**
  * Functions an anonymous visitor can call that run past the rules. Read from
  * the shape, not attacked. Quiet: a yes/no about the caller, and a function
@@ -521,7 +559,14 @@ function nightlyRecord(latest, readAt, plan) {
   // functions anyone can call - read now, when this is asked, because the
   // engine inside the database does not look at them.
   const tag = plan ? taggerFor(plan, plan.tables) : (f) => f;
-  const night = (run.findings || []).map((f) => tag(Object.assign({}, f, { fromNight: true })));
+  // A loop the engine could not name ("stack depth limit exceeded") is put
+  // on the tables whose own rule reads back into them, read from the shape.
+  const loops = plan ? loopingTables(plan) : [];
+  const night = [];
+  for (const f of run.findings || []) {
+    const at = f.kind === 'recursive' && !f.table ? (loops.length ? loops : ['one of your tables']) : [f.table];
+    for (const table of at) night.push(tag(Object.assign({}, f, { table: table, fromNight: true })));
+  }
   const now = plan ? privilegedOf(plan).map(tag) : [];
   return Object.assign(record, {
     ranAt: at(run.ran_at),
@@ -842,6 +887,7 @@ module.exports = {
   scheduleTimes: scheduleTimes,
   notCheckedFromNight: notCheckedFromNight,
   privilegedOf: privilegedOf,
+  loopingTables: loopingTables,
   taggerFor: taggerFor,
   saveNightly: saveNightly,
   sweepOldCopies: sweepOldCopies,

package/schema.js

@@ -322,6 +322,40 @@ async function readAnonDefinerFunctions(client, schema, role) {
   });
 }
 
+/**
+ * The app's own SQL and PL/pgSQL functions, with their full definitions.
+ *
+ * Read so the helpers a rule calls can be built inside the copy. Found on a
+ * blind test: a rule called has_org_role(org_id, ARRAY[...]::org_role[]). The
+ * copy has its own org_role, the helper stayed in the original schema taking
+ * the original's, and no rule could be created - the scan stopped before it
+ * began. Left in the original, a helper also answers from the original's
+ * tables rather than from the copy's.
+ */
+async function readFunctions(client, schema) {
+  const { rows } = await client.query(
+    `SELECT p.proname AS name,
+            l.lanname AS language,
+            p.prosrc AS src,
+            pg_get_functiondef(p.oid) AS def,
+            pg_get_function_identity_arguments(p.oid) AS args,
+            p.proacl IS NULL AS default_acl,
+            (SELECT coalesce(array_agg(g ORDER BY g), '{}'::text[])
+               FROM (SELECT DISTINCT CASE WHEN a.grantee = 0 THEN 'PUBLIC' ELSE pg_get_userbyid(a.grantee)::text END AS g
+                       FROM aclexplode(p.proacl) a
+                      WHERE a.privilege_type = 'EXECUTE' AND a.grantee <> p.proowner) x) AS executors
+       FROM pg_proc p
+       JOIN pg_namespace n ON n.oid = p.pronamespace
+       JOIN pg_language l ON l.oid = p.prolang
+      WHERE n.nspname = $1
+        AND p.prokind = 'f'
+        AND p.prorettype <> 'pg_catalog.trigger'::regtype
+      ORDER BY p.proname, p.oid`,
+    [schema],
+  );
+  return rows;
+}
+
 async function readPolicies(client, schema) {
   const { rows } = await client.query(
     `SELECT tablename AS table_name,
@@ -597,6 +631,7 @@ async function readSchema(client, schema) {
     viewGrants: await readViewGrants(client, schema),
     external: external,
     anonFunctions: await readAnonDefinerFunctions(client, schema),
+    functions: await readFunctions(client, schema),
     unsupported: unsupported,
   };
 }
@@ -656,18 +691,19 @@ function rewriteSchemaRefs(expr, fromSchema, toSchema) {
  * since source and copy printed the same words.
  *
  * Not rewriteSchemaRefs, which moves every "kn_app." it finds: a rule calling
- * one of the app's functions (kn_app.whoami()) has to keep calling it,
- * because functions are not copied, and pointing it at the copy makes the
- * CREATE POLICY fail. Only names that are tables or views of this app move.
- * A name followed by more identifier characters is a different name -
- * members_log is not members - so the match stops at a word boundary.
+ * one of the app's functions that is not copied (kn_app.whoami() in another
+ * language) has to keep calling it, and pointing it at the copy makes the
+ * CREATE POLICY fail. Only tables, views, and the functions the copy was
+ * given (copiedFunctions) move. A name followed by more identifier characters
+ * is a different name - members_log is not members - so the match stops at a
+ * word boundary.
  */
-function rewriteOwnTableRefs(expr, plan, target) {
+function rewriteOwnTableRefs(expr, plan, target, copiedFunctions) {
   if (expr === null || expr === undefined) return expr;
   const escape = (s) => s.replace(/[.*+?^${}()|[\]\\]/g, '\\$&');
   const simple = (s) => /^[a-z_][a-z0-9_$]*$/.test(s);
   const schemaForms = [quote(plan.schema)].concat(simple(plan.schema) ? [plan.schema] : []);
-  const own = (plan.tables || []).map((t) => t.name).concat((plan.views || []).map((v) => v.name));
+  const own = (plan.tables || []).map((t) => t.name).concat((plan.views || []).map((v) => v.name), copiedFunctions || []);
   let out = String(expr);
   for (const name of own) {
     const nameForms = [quote(name)].concat(simple(name) ? [name] : []);
@@ -681,6 +717,61 @@ function rewriteOwnTableRefs(expr, plan, target) {
   return out;
 }
 
+/**
+ * Which of the app's functions the copy needs: every SQL or PL/pgSQL function
+ * a rule or a view calls, and every one those call in turn. Matched by name
+ * followed by "(", bare or schema-qualified; every overload of a name comes
+ * along. Functions in other languages stay where they are.
+ */
+function functionsToCopy(plan) {
+  const copyable = (plan.functions || []).filter((f) => f.language === 'sql' || f.language === 'plpgsql');
+  const names = Array.from(new Set(copyable.map((f) => f.name)));
+  const escape = (s) => s.replace(/[.*+?^${}()|[\]\\]/g, '\\$&');
+  const calls = (text, name) => new RegExp('(^|[^A-Za-z0-9_$])"?' + escape(name) + '"?\\s*\\(').test(String(text || ''));
+  const seeds = []
+    .concat((plan.policies || []).map((p) => String(p.qual || '') + ' ' + String(p.with_check || '')))
+    .concat((plan.views || []).map((v) => v.definition));
+  const wanted = new Set(names.filter((name) => seeds.some((text) => calls(text, name))));
+  // And whatever those call, until nothing new turns up.
+  let grew = true;
+  while (grew) {
+    grew = false;
+    for (const f of copyable) {
+      if (!wanted.has(f.name)) continue;
+      for (const name of names) {
+        if (!wanted.has(name) && calls(f.src, name)) {
+          wanted.add(name);
+          grew = true;
+        }
+      }
+    }
+  }
+  return copyable.filter((f) => wanted.has(f.name));
+}
+
+/**
+ * One of the app's functions, rebuilt in the copy: the same body and settings,
+ * its name in the copy, its references to the app's own tables, views and
+ * copied functions pointed at the copy, and a pinned search_path that looks in
+ * the copy first and the original second (for what the copy does not have,
+ * such as an extension's functions).
+ */
+function copyFunctionStatement(fn, plan, target, copiedNames) {
+  const escape = (s) => s.replace(/[.*+?^${}()|[\]\\]/g, '\\$&');
+  const schemaForms = [quote(plan.schema), plan.schema].map(escape).join('|');
+  let def = String(fn.def).replace(
+    new RegExp('^CREATE OR REPLACE FUNCTION\\s+(?:' + schemaForms + ')\\.'),
+    () => 'CREATE FUNCTION ' + quote(target) + '.',
+  );
+  // The settings line, e.g.  SET search_path TO 'public', 'storage'
+  def = def.replace(/^(\s*SET search_path (?:TO|=) )(.*)$/m, (all, head, list) =>
+    head + list.split(',').map((part) => {
+      const bare = part.trim().replace(/^'(.*)'$/, '$1').replace(/^"(.*)"$/, '$1');
+      return bare === plan.schema ? "'" + target + "', " + part.trim() : part.trim();
+    }).join(', '));
+  return rewriteOwnTableRefs(def, plan, target, copiedNames);
+}
+
 /**
  * Points a reference with no schema on it at the copy.
  *
@@ -940,6 +1031,29 @@ async function writeSchema(client, plan, target) {
     statements.push(rewriteSchemaRefs(index.definition, plan.schema, target));
   }
 
+  // The helpers the rules and views call, after the tables their bodies read
+  // and before anything that calls them.
+  const copied = functionsToCopy(plan);
+  const copiedNames = Array.from(new Set(copied.map((f) => f.name)));
+  // The app's own types move with them: a copied helper taking app.role_t[]
+  // has to take the copy's role_t, or the copy's columns cannot be compared
+  // with its arguments.
+  const movedNames = copiedNames.concat((plan.types || []).map((t) => t.name));
+  for (const fn of copied) {
+    statements.push(copyFunctionStatement(fn, plan, target, movedNames));
+    // Who may call it, as in the original. Found by the blocked-read check: a
+    // helper the original had closed to anon and authenticated came out of
+    // the copy open to everyone, and a rule that cannot be evaluated was
+    // reported as evaluated.
+    if (!fn.default_acl) {
+      const signature = quote(target) + '.' + quote(fn.name) + '(' + rewriteOwnTableRefs(fn.args, plan, target, movedNames) + ')';
+      statements.push('REVOKE ALL ON FUNCTION ' + signature + ' FROM PUBLIC');
+      for (const who of fn.executors || []) {
+        statements.push('GRANT EXECUTE ON FUNCTION ' + signature + ' TO ' + (who === 'PUBLIC' ? 'PUBLIC' : quote(who)));
+      }
+    }
+  }
+
   // Views last, because they read from the tables above. Copied rather than
   // skipped because a view is a way into a table: it runs with its creator
   // rights unless it says security_invoker, so a view over a protected table
@@ -1011,8 +1125,8 @@ async function writeSchema(client, plan, target) {
       'FOR ' + policy.cmd,
       'TO ' + roles,
     ];
-    if (policy.qual) parts.push('USING (' + rewriteOwnTableRefs(policy.qual, plan, target) + ')');
-    if (policy.with_check) parts.push('WITH CHECK (' + rewriteOwnTableRefs(policy.with_check, plan, target) + ')');
+    if (policy.qual) parts.push('USING (' + rewriteOwnTableRefs(policy.qual, plan, target, movedNames) + ')');
+    if (policy.with_check) parts.push('WITH CHECK (' + rewriteOwnTableRefs(policy.with_check, plan, target, movedNames) + ')');
     statements.push(parts.join(' '));
   }
 
@@ -1277,6 +1391,8 @@ module.exports = {
   referenceIn: referenceIn,
   rewriteSchemaRefs: rewriteSchemaRefs,
   qualifyOwnRefs: qualifyOwnRefs,
+  functionsToCopy: functionsToCopy,
+  copyFunctionStatement: copyFunctionStatement,
   stubNameFor: stubNameFor,
   IDENTITIES: IDENTITIES,
   quote: quote,

package/trouble.js

@@ -365,7 +365,7 @@ function supabaseDirectRef(raw) {
  * survives is the stack: the person cannot use it and it makes the tool look
  * like it broke rather than like it has something to tell them.
  */
-function explain(err, raw) {
+function explain(err, raw, options) {
   const code = err && err.code ? String(err.code) : '';
 
   // Checked before the general ENOTFOUND, because for this one address the
@@ -448,6 +448,18 @@ function explain(err, raw) {
 
   // Nothing matched. Say what happened and where, without pretending to know
   // why, and without the stack.
+  //
+  // After the connection was made, "I could not connect" is untrue - found on
+  // a blind test, where it was printed over a copy that could not be built.
+  if (options && options.connected) {
+    return [
+      'I connected, but the check stopped part-way.',
+      '',
+      'The server said: ' + message,
+      '',
+      'Nothing was left behind: the temporary copy is deleted whenever a check stops.',
+    ];
+  }
   const lines = [
     'I could not connect to the database.',
     '',