kryptheon-night 0.1.26 → 0.1.29

package/README.md

@@ -74,7 +74,7 @@ whether they are meant:
 
 | check | the question |
 |---|---|
-| **Lowest role** | can a viewer in a team change what is in it? (tried on the copy, undone) |
+| **Team roles** | which role in a team, from the lowest up, can change what its rules do not list it for, and which can read its tokens, keys and payloads? (tried on the copy, undone) |
 | **Storage** | is a bucket public although a rule says who may read it? (settings only, never a file) |
 | **Open functions** | can a visitor with no account call a function that skips the rules? |
 

package/attack.js

@@ -204,6 +204,48 @@ function allowedByCheck(table, columnName) {
   return found;
 }
 
+/**
+ * Sets of columns where exactly one may be filled in.
+ *
+ * Found on a blind test (HelixOps): documents belonged to a work order or to
+ * an inspection, never both, written
+ *   CHECK ((work_order_id IS NOT NULL)::int + (inspection_id IS NOT NULL)::int = 1)
+ * Both parents were there, so the seeder pointed the row at both, the CHECK
+ * refused every attempt, and the table was never tested at all.
+ *
+ * Two spellings are read - that sum, and num_nonnulls(a, b, ...) = 1 - and
+ * only when the constraint says nothing else. A CHECK with anything more in it
+ * is left alone rather than half understood.
+ */
+function exactlyOne(table) {
+  const groups = [];
+  const name = '("(?:[^"]|"")+"|[A-Za-z_][A-Za-z0-9_$]*)';
+  const unquote = (text) => (text.charAt(0) === '"' ? text.slice(1, -1).split('""').join('"') : text);
+  for (const constraint of table.constraints || []) {
+    if (constraint.kind !== 'c') continue;
+    const definition = String(constraint.definition || '');
+    let columns = [];
+    let rest = definition;
+    const summed = new RegExp('\\(\\(' + name + ' IS NOT NULL\\)\\)::integer', 'gi');
+    let match;
+    while ((match = summed.exec(definition)) !== null) columns.push(unquote(match[1]));
+    rest = rest.replace(summed, '').replace(/\+/g, '');
+    if (!columns.length) {
+      const counted = /num_nonnulls\(([^()]*)\)/i.exec(definition);
+      if (counted) {
+        const listed = new RegExp(name, 'g');
+        let one;
+        while ((one = listed.exec(counted[1])) !== null) columns.push(unquote(one[1]));
+        rest = rest.replace(counted[0], '');
+      }
+    }
+    // Nothing may be left but the CHECK itself, brackets and "= 1".
+    if (columns.length < 2 || rest.replace(/[()\s]/g, '').toUpperCase() !== 'CHECK=1') continue;
+    groups.push(columns);
+  }
+  return groups;
+}
+
 /**
  * The foreign keys on a table, read out of Postgres's own wording.
  *
@@ -395,12 +437,28 @@ async function rowFor(client, schema, table, person, distinct, overrides, attemp
   const partOfKey = new Set();
   for (const key of foreignKeys(table)) key.columns.forEach((name) => partOfKey.add(name));
 
+  // Where exactly one of a set may be filled in: the one already chosen, or
+  // else the first that can be - a key needs a parent row to point at. The
+  // rest are written as nothing, whatever their default.
+  const chosen = (name) => Object.prototype.hasOwnProperty.call(forced, name);
+  const onlyOne = new Map();
+  for (const group of exactlyOne(table)) {
+    const kept = group.find(chosen) || group.find((name) => !partOfKey.has(name) || borrowed.has(name));
+    for (const name of group) onlyOne.set(name, name === kept);
+  }
+
   for (const column of table.columns) {
     if (Object.prototype.hasOwnProperty.call(forced, column.name)) {
       columns.push(column.name);
       values.push(forced[column.name]);
       continue;
     }
+    if (onlyOne.get(column.name) === false) {
+      columns.push(column.name);
+      values.push(null);
+      continue;
+    }
+    const mustFill = onlyOne.get(column.name) === true;
     if (column.name === owner) {
       columns.push(column.name);
       values.push(person);
@@ -436,9 +494,11 @@ async function rowFor(client, schema, table, person, distinct, overrides, attemp
       values.push(borrowed.get(column.name));
       continue;
     }
-    // Anything with a default can supply its own value.
+    // Anything with a default can supply its own value. A column that may be
+    // empty is left empty - unless it is the one of a set that has to be
+    // filled in.
     if (column.default_expr) continue;
-    if (!column.not_null) continue;
+    if (!column.not_null && !mustFill) continue;
     columns.push(column.name);
     // A CHECK that lists what it will accept beats anything invented here.
     const allowed = allowedByCheck(table, column.name);
@@ -766,6 +826,7 @@ module.exports = {
   dependencyOrder: dependencyOrder,
   valueFor: valueFor,
   allowedByCheck: allowedByCheck,
+  exactlyOne: exactlyOne,
   rowFor: rowFor,
   existingRow: existingRow,
   insertRow: insertRow,

package/bin/kryptheon-night.js

@@ -648,7 +648,9 @@ async function main() {
       if (result.findings.length) scanner.report(result);
       else scanner.notTestedLines(result).forEach(line);
       scanner.saveRun(file, result);
-      process.exitCode = result.stopped ? 2 : verdict.allClear ? 0 : 1;
+      // Two different databases: the verdict is a comparison, so the exit
+      // code is this run's own answer, the same as a first run.
+      process.exitCode = result.stopped ? 2 : verdict.elsewhere ? scanner.exitCodeFor(result) : verdict.allClear ? 0 : 1;
     }
 
     // And then the only other thing worth doing, offered rather than

package/collision.js

@@ -69,6 +69,20 @@ const MUST_BE_UNIQUE = [
  */
 const ACCOUNT_TABLE = /^(users?|profiles?|accounts?|members?|auth_users|app_users|logins?)$/i;
 
+/**
+ * Tables that keep another service's credentials, so this app can call it.
+ *
+ * A token there was issued by somebody else and opens nothing in this app, so
+ * two rows sharing one is not a way in. Found on a blind test (LaunchRail):
+ * integration_credentials.access_token and refresh_token were reported as
+ * "can exist twice" - not in the answer key, and not a door into the app.
+ * Known by the table's name, or by a `provider` column naming the service.
+ */
+const OUTBOUND_TABLE = /(^|_)(integrations?|providers?|oauth|connections?|connectors?|external|third_party)(_|$)/i;
+function holdsOutboundCredentials(table) {
+  return OUTBOUND_TABLE.test(table.name) || (table.columns || []).some((c) => /^provider$/i.test(c.name));
+}
+
 /** Everything on a table that already promises "only one of these". */
 function uniquenessTexts(table, indexes) {
   const fromConstraints = (table.constraints || [])
@@ -118,6 +132,7 @@ function candidates(tables, indexes) {
       const rule = MUST_BE_UNIQUE.find((r) => r.test.test(column.name));
       if (!rule) continue;
       if (rule.accountTablesOnly && !ACCOUNT_TABLE.test(table.name)) continue;
+      if (rule.expectation === 'credential' && holdsOutboundCredentials(table)) continue;
       found.push({
         table: table.name,
         column: column.name,