kryptheon-night 0.1.25 → 0.1.27

package/README.md

@@ -69,6 +69,17 @@ Four questions, asked against the copy:
 | **Collision** | can the same thing exist twice? |
 | **Interruption** | can a half-finished write survive? |
 
+And three things it says are **yours to check**, because only you know
+whether they are meant:
+
+| check | the question |
+|---|---|
+| **Lowest role** | can a viewer in a team change or add to what is in it, and which roles can read its tokens, keys and payloads? (tried on the copy, undone) |
+| **Storage** | is a bucket public although a rule says who may read it? (settings only, never a file) |
+| **Open functions** | can a visitor with no account call a function that skips the rules? |
+
+These are listed apart from problems and do not change the exit code.
+
 A problem reads like this:
 
     CRITICAL   customers

package/attack.js

@@ -204,6 +204,48 @@ function allowedByCheck(table, columnName) {
   return found;
 }
 
+/**
+ * Sets of columns where exactly one may be filled in.
+ *
+ * Found on a blind test (HelixOps): documents belonged to a work order or to
+ * an inspection, never both, written
+ *   CHECK ((work_order_id IS NOT NULL)::int + (inspection_id IS NOT NULL)::int = 1)
+ * Both parents were there, so the seeder pointed the row at both, the CHECK
+ * refused every attempt, and the table was never tested at all.
+ *
+ * Two spellings are read - that sum, and num_nonnulls(a, b, ...) = 1 - and
+ * only when the constraint says nothing else. A CHECK with anything more in it
+ * is left alone rather than half understood.
+ */
+function exactlyOne(table) {
+  const groups = [];
+  const name = '("(?:[^"]|"")+"|[A-Za-z_][A-Za-z0-9_$]*)';
+  const unquote = (text) => (text.charAt(0) === '"' ? text.slice(1, -1).split('""').join('"') : text);
+  for (const constraint of table.constraints || []) {
+    if (constraint.kind !== 'c') continue;
+    const definition = String(constraint.definition || '');
+    let columns = [];
+    let rest = definition;
+    const summed = new RegExp('\\(\\(' + name + ' IS NOT NULL\\)\\)::integer', 'gi');
+    let match;
+    while ((match = summed.exec(definition)) !== null) columns.push(unquote(match[1]));
+    rest = rest.replace(summed, '').replace(/\+/g, '');
+    if (!columns.length) {
+      const counted = /num_nonnulls\(([^()]*)\)/i.exec(definition);
+      if (counted) {
+        const listed = new RegExp(name, 'g');
+        let one;
+        while ((one = listed.exec(counted[1])) !== null) columns.push(unquote(one[1]));
+        rest = rest.replace(counted[0], '');
+      }
+    }
+    // Nothing may be left but the CHECK itself, brackets and "= 1".
+    if (columns.length < 2 || rest.replace(/[()\s]/g, '').toUpperCase() !== 'CHECK=1') continue;
+    groups.push(columns);
+  }
+  return groups;
+}
+
 /**
  * The foreign keys on a table, read out of Postgres's own wording.
  *
@@ -395,12 +437,28 @@ async function rowFor(client, schema, table, person, distinct, overrides, attemp
   const partOfKey = new Set();
   for (const key of foreignKeys(table)) key.columns.forEach((name) => partOfKey.add(name));
 
+  // Where exactly one of a set may be filled in: the one already chosen, or
+  // else the first that can be - a key needs a parent row to point at. The
+  // rest are written as nothing, whatever their default.
+  const chosen = (name) => Object.prototype.hasOwnProperty.call(forced, name);
+  const onlyOne = new Map();
+  for (const group of exactlyOne(table)) {
+    const kept = group.find(chosen) || group.find((name) => !partOfKey.has(name) || borrowed.has(name));
+    for (const name of group) onlyOne.set(name, name === kept);
+  }
+
   for (const column of table.columns) {
     if (Object.prototype.hasOwnProperty.call(forced, column.name)) {
       columns.push(column.name);
       values.push(forced[column.name]);
       continue;
     }
+    if (onlyOne.get(column.name) === false) {
+      columns.push(column.name);
+      values.push(null);
+      continue;
+    }
+    const mustFill = onlyOne.get(column.name) === true;
     if (column.name === owner) {
       columns.push(column.name);
       values.push(person);
@@ -436,9 +494,11 @@ async function rowFor(client, schema, table, person, distinct, overrides, attemp
       values.push(borrowed.get(column.name));
       continue;
     }
-    // Anything with a default can supply its own value.
+    // Anything with a default can supply its own value. A column that may be
+    // empty is left empty - unless it is the one of a set that has to be
+    // filled in.
     if (column.default_expr) continue;
-    if (!column.not_null) continue;
+    if (!column.not_null && !mustFill) continue;
     columns.push(column.name);
     // A CHECK that lists what it will accept beats anything invented here.
     const allowed = allowedByCheck(table, column.name);
@@ -766,6 +826,7 @@ module.exports = {
   dependencyOrder: dependencyOrder,
   valueFor: valueFor,
   allowedByCheck: allowedByCheck,
+  exactlyOne: exactlyOne,
   rowFor: rowFor,
   existingRow: existingRow,
   insertRow: insertRow,

package/bin/kryptheon-night.js

@@ -648,7 +648,9 @@ async function main() {
       if (result.findings.length) scanner.report(result);
       else scanner.notTestedLines(result).forEach(line);
       scanner.saveRun(file, result);
-      process.exitCode = result.stopped ? 2 : verdict.allClear ? 0 : 1;
+      // Two different databases: the verdict is a comparison, so the exit
+      // code is this run's own answer, the same as a first run.
+      process.exitCode = result.stopped ? 2 : verdict.elsewhere ? scanner.exitCodeFor(result) : verdict.allClear ? 0 : 1;
     }
 
     // And then the only other thing worth doing, offered rather than