kryptheon-night 0.1.30 → 0.1.32

package/schema.js

@@ -225,6 +225,25 @@ async function readIndexes(client, schema) {
  * argument the caller chose.
  */
 function guardedAtTheDoor(body, helpers) {
+  return doorOf(body, helpers).guarded;
+}
+
+/**
+ * The same reading, and one more answer: whether the only check at the door
+ * is one a caller with no role at all slips past.
+ *
+ * Found on a blind test (HarborLine): complete_automation_run opened with
+ *   if public.org_role(v_org) not in ('owner', 'admin') then raise ...
+ * org_role answers with the caller's role there - and with NULL for somebody
+ * who has none. NULL NOT IN (...) is not true, so the IF never raises, and a
+ * stranger completed another organization's runs. A role helper's check is a
+ * guard only when it is written so NULL cannot pass - coalesce(...), or
+ * IS NULL OR ... - and otherwise it is said, by name, why it is not one.
+ *
+ * `helpers` are names (yes/no helpers about the caller) or { name, nullable }
+ * (a role helper, which answers NULL for a stranger).
+ */
+function doorOf(body, helpers) {
   const text = String(body || '');
   const writes = /\b(insert\s+into|update\s+(only\s+)?["\w]+|delete\s+from|truncate|merge\s+into)\b/i.exec(text);
   const returns = /\breturn\b/i.exec(text);
@@ -236,17 +255,26 @@ function guardedAtTheDoor(body, helpers) {
   // never as the tail of a longer name.
   const asks = (cond, name) => new RegExp('(^|[^\\w$"])"?' +
     name.replace(/[$]/g, '\\$') + '"?\\s*\\(', 'i').test(cond);
+  const list = (helpers || []).map((h) => (typeof h === 'string' ? { name: h, nullable: false } : h));
+  let slips = false;
   let found;
   while ((found = guard.exec(text)) !== null) {
     if (found.index > firstAct) break;
     const cond = found[1].trim();
     // Refusing when the check fails, not when it passes.
     const refusesOnNo = /^not\b/i.test(cond) || /\bis\s+(not\s+true|false)\s*$/i.test(cond) || /=\s*false\s*$/i.test(cond);
-    if (!refusesOnNo) continue;
-    if ((helpers || []).some((name) => asks(cond, name))) return true;
-    if (/\bauth\s*\.\s*(uid|jwt)\s*\(/i.test(cond) && /admin|owner|member|role/i.test(cond)) return true;
+    if (refusesOnNo && list.some((h) => !h.nullable && asks(cond, h.name))) return { guarded: true, nullSlips: false };
+    if (refusesOnNo && /\bauth\s*\.\s*(uid|jwt)\s*\(/i.test(cond) && /admin|owner|member|role/i.test(cond)) {
+      return { guarded: true, nullSlips: false };
+    }
+    if (list.some((h) => h.nullable && asks(cond, h.name))) {
+      const refuses = refusesOnNo || /\bnot\s+in\s*\(/i.test(cond) || /<>|!=/.test(cond);
+      const nullSafe = /\bcoalesce\s*\(/i.test(cond) || /\bis\s+null\b/i.test(cond) || /\bis\s+not\s+true\s*$/i.test(cond);
+      if (refuses && nullSafe) return { guarded: true, nullSlips: false };
+      if (refuses) slips = true;
+    }
   }
-  return false;
+  return { guarded: false, nullSlips: slips };
 }
 
 async function readAnonDefinerFunctions(client, schema, role) {
@@ -262,6 +290,7 @@ async function readAnonDefinerFunctions(client, schema, role) {
             p.proconfig::text AS config,
             pg_get_functiondef(p.oid) AS def,
             p.prorettype = 'pg_catalog.bool'::regtype AS returns_bool,
+            (SELECT t.typtype = 'e' FROM pg_type t WHERE t.oid = p.prorettype) AS returns_enum,
             ${exists.rows.length ? "has_function_privilege($2, p.oid, 'EXECUTE')" : 'false'} AS callable
        FROM pg_proc p
        JOIN pg_namespace n ON n.oid = p.pronamespace
@@ -271,21 +300,25 @@ async function readAnonDefinerFunctions(client, schema, role) {
       ORDER BY p.proname`,
     exists.rows.length ? [schema, caller] : [schema],
   );
-  // The schema's yes/no helpers about the caller - is_org_admin(org) asking
-  // whether auth.uid() is an admin of it - definer or not, since a guard can
-  // call either. Read once, for guardedAtTheDoor.
+  // The schema's helpers about the caller - is_org_admin(org) asking whether
+  // auth.uid() is an admin of it, org_role(org) answering with their role -
+  // definer or not, since a guard can call either. Read once, for doorOf. A
+  // role helper answers NULL for somebody with no role, so it is marked.
   const { rows: yesNo } = await client.query(
-    `SELECT p.proname AS name, pg_get_functiondef(p.oid) AS def
+    `SELECT p.proname AS name, pg_get_functiondef(p.oid) AS def,
+            p.prorettype <> 'pg_catalog.bool'::regtype AS nullable
        FROM pg_proc p
        JOIN pg_namespace n ON n.oid = p.pronamespace
-      WHERE n.nspname = $1 AND p.prokind = 'f' AND p.prorettype = 'pg_catalog.bool'::regtype`,
+       JOIN pg_type t ON t.oid = p.prorettype
+      WHERE n.nspname = $1 AND p.prokind = 'f' AND (p.prorettype = 'pg_catalog.bool'::regtype OR t.typtype = 'e')
+      ORDER BY p.proname`,
     [schema],
   );
   const helpers = yesNo.filter((row) => {
     const body = String(row.def || '').replace(/--[^\n]*/g, ' ');
     return /\bauth\s*\.\s*(uid|jwt)\s*\(/i.test(body) &&
       !/\b(insert\s+into|update\s+(only\s+)?["\w]+|delete\s+from|truncate|merge\s+into)\b/i.test(body);
-  }).map((row) => row.name);
+  }).map((row) => ({ name: row.name, nullable: row.nullable === true }));
   return rows.map((row) => {
     // A definer function with no search_path pinned is a second, separate
     // hazard: the caller can set their own search_path and make the function
@@ -309,13 +342,21 @@ async function readAnonDefinerFunctions(client, schema, role) {
     // else and writing nothing, they are not a reach. A yes/no that does not
     // ask auth.uid() - is_admin(user_id) - answers about other people, and
     // stays a finding.
-    const aboutCaller = row.returns_bool === true && !writes && /\bauth\s*\.\s*(uid|jwt)\s*\(/i.test(body);
+    //
+    // A role about the caller alone is the same: org_role(org), the caller's
+    // own role there, from a fixed list of labels (an enum) that can hold
+    // nothing about anybody else. Found on a blind test (HarborLine), where
+    // org_role was reported beside the functions it guards.
+    const aboutCaller = (row.returns_bool === true || row.returns_enum === true) && !writes &&
+      /\bauth\s*\.\s*(uid|jwt)\s*\(/i.test(body);
+    const door = doorOf(body, helpers);
     return {
       name: row.name,
       args: row.args || '',
       writes: writes,
       aboutCaller: aboutCaller,
-      guarded: guardedAtTheDoor(body, helpers),
+      guarded: door.guarded,
+      nullSlips: door.nullSlips,
       hasFixedSearchPath: hasFixedSearchPath,
       callable: row.callable === true,
     };
@@ -1438,6 +1479,7 @@ module.exports = {
   readSchema: readSchema,
   readAnonDefinerFunctions: readAnonDefinerFunctions,
   guardedAtTheDoor: guardedAtTheDoor,
+  doorOf: doorOf,
   writeSchema: writeSchema,
   diffSchemas: diffSchemas,
   readPolicies: readPolicies,

package/tamper.js

@@ -114,6 +114,11 @@ async function tamper(client, schema, tables, seeded, policies) {
     rulesFor.set(policy.table_name, list);
   }
 
+  // The first person's row in tables that hold one for each person but name
+  // nobody (attack.seed), so a write is aimed at a row that is not the
+  // caller's own.
+  const firstRowOf = new Map((seeded || []).filter((entry) => entry.rowOfA).map((entry) => [entry.table, entry.rowOfA]));
+
   for (const table of tables) {
     if (!shapeFor.has(table.name)) continue; // never seeded, so nothing to protect
     const owner = attack.ownerColumn(table);
@@ -127,9 +132,12 @@ async function tamper(client, schema, tables, seeded, policies) {
       // Rows belonging to the other fake person. Scoped on purpose: a signed-in
       // customer deleting their OWN rows is not a finding, it is the feature,
       // and an unscoped DELETE would report every correctly built app.
+      const firstRow = firstRowOf.get(table.name);
       const theirRows = owner
         ? ' WHERE ' + quote(owner) + ' = ' + "'" + attack.USER_A + "'"
-        : '';
+        : firstRow
+          ? ' WHERE ' + quote(firstRow.column) + "::text = '" + firstRow.value.split("'").join("''") + "'"
+          : '';
       const at = quote(schema) + '.' + quote(table.name);
 
       // Written under a name nobody has used, which is both what makes the
@@ -334,7 +342,8 @@ function memberships(tables) {
 }
 
 // What each kind of write is called in a rule.
-const COMMAND = { add: 'INSERT', change: 'UPDATE', delete: 'DELETE' };
+// A takeover is an UPDATE too: a rule for updating is what it would hide behind.
+const COMMAND = { add: 'INSERT', change: 'UPDATE', delete: 'DELETE', takeover: 'UPDATE' };
 
 /**
  * Whether the app's own rules name this role among those allowed to make
@@ -478,6 +487,22 @@ async function teammate(client, schema, tables, seeded, rules) {
         { what: 'change', statement: 'UPDATE ' + target + ' SET ' + column + ' = ' + column + notTheirs, values: [] },
         { what: 'delete', statement: 'DELETE FROM ' + target + notTheirs, values: [] },
       ];
+      // On the members table itself: putting their own id on the first
+      // person's membership row - taking that member's place, and their role.
+      // Found on a blind test (HarborLine): a member could update any member
+      // row of the team, and repointing an admin's row made them admin. A rule
+      // that lets a role edit memberships does not make this the design, so
+      // it is asked of every role, listed or not.
+      if (table.name === member.table.name) {
+        const firstPersons = [quote(member.person) + " = '" + attack.USER_A + "'"]
+          .concat(Object.keys(pointed).map((name) => quote(name) + " = '" + String(pointed[name]).split("'").join("''") + "'"));
+        moves.push({
+          what: 'takeover',
+          anyRole: true,
+          statement: 'UPDATE ' + target + ' SET ' + quote(member.person) + " = '" + attack.USER_B + "' WHERE " + firstPersons.join(' AND '),
+          values: [],
+        });
+      }
       // Adding a row to the team, said only of a role whose own name says it
       // may only look: a member adding rows is the feature, a viewer adding
       // them is not. Found on a blind test (HelixOps): any member could add
@@ -534,7 +559,7 @@ async function teammate(client, schema, tables, seeded, rules) {
           // A write the rules list this role for is not asked: whatever it
           // did would not be reported, and a key refusing it on the way out
           // left the table untested (HelixOps' assets, as a dispatcher).
-          if (allowedByRules(rules, table.name, move.what, role, member.roleType)) {
+          if (!move.anyRole && allowedByRules(rules, table.name, move.what, role, member.roleType)) {
             listed = true;
             continue;
           }
@@ -554,7 +579,7 @@ async function teammate(client, schema, tables, seeded, rules) {
         }
         completed.push(key);
         if (can.length) {
-          findings.push({
+          findings.push(Object.assign({
             kind: 'role',
             table: table.name,
             who: role,
@@ -566,7 +591,7 @@ async function teammate(client, schema, tables, seeded, rules) {
             below: below.slice(),
             columns: (table.columns || []).map((c) => c.name),
             rlsEnabled: table.rlsEnabled,
-          });
+          }, can.includes('takeover') ? { takeover: true, personColumn: member.person } : {}));
           break;
         }
         if (!listed) below.push(role);