kryptheon-night 0.1.31 → 0.1.33

package/attack.js

@@ -204,6 +204,132 @@ function allowedByCheck(table, columnName) {
   return found;
 }
 
+/**
+ * The CHECK constraints on a table that name this column, as the expression
+ * inside CHECK (...). A NOT VALID one still applies to every new row.
+ */
+function checksOn(table, columnName) {
+  const escaped = String(columnName).replace(/[.*+?^${}()|[\]\\]/g, '\\$&');
+  const named = new RegExp('(^|[^A-Za-z0-9_$"])("' + escaped.split('"').join('""') + '"|' + escaped + ')($|[^A-Za-z0-9_$"])');
+  const found = [];
+  for (const constraint of table.constraints || []) {
+    if (constraint.kind !== 'c') continue;
+    const definition = String(constraint.definition || '');
+    if (!named.test(definition)) continue;
+    found.push(definition.replace(/^CHECK\s*/i, '').replace(/\s+NOT VALID\s*$/i, ''));
+  }
+  return found;
+}
+
+const NUMERIC_KIND = /^(integer|bigint|smallint|numeric|decimal|real|double)/;
+const TEXT_KIND = /^(text|character|varchar|citext)/;
+
+/**
+ * Values to offer a column whose CHECK could not be read, best first.
+ *
+ * Found on a real app (a clinic's, 2026-10-11): patient_waitlist and
+ * whatsapp_contacts each had a phone number column with a CHECK on its
+ * format, compliance_requests a type column with a CHECK no reading here
+ * understood - and none of the made-up values fitted, so three tables, and a
+ * fourth that pointed at one of them, were never tested. Nothing here reads
+ * the rule. Each value is put to the rule itself, in the database
+ * (fittingValue), and the first it accepts is used.
+ *
+ * Mirrored by __KN__.check_candidates in engine.sql, value for value and in
+ * the same order: both engines must seed the same rows.
+ */
+function checkCandidates(column, definitions, distinct) {
+  const kind = String(column.base_type || column.type).toLowerCase();
+  const tag = distinct === undefined || distinct === null ? '' : String(distinct);
+  const step = Number(tag) || 0;
+  const out = [];
+  const add = (value) => { if (out.indexOf(value) === -1) out.push(value); };
+  if (NUMERIC_KIND.test(kind)) {
+    [1 + step, 18 + step, 100 + step, 1000 + step, 0, 5].forEach((n) => add(String(n)));
+    for (const definition of definitions) {
+      const numbers = definition.match(/-?\d+(?:\.\d+)?/g) || [];
+      numbers.forEach(add);
+    }
+    return out;
+  }
+  if (!TEXT_KIND.test(kind)) return out;
+  const d = String(step % 10);
+  const phones = ['+1415555012' + d, '+919876543' + (210 + step), '9876543' + (210 + step), '415555012' + d,
+    '+1 415-555-012' + d, '(415) 555-012' + d, '415-555-012' + d, '+44 7700 90012' + d, '07700 90012' + d];
+  const emails = ['kryptheon' + tag + '@example.com'];
+  const links = ['https://example.com/kryptheon' + tag];
+  // The shapes valueFor offers, in its order, so a rule they already passed
+  // still gets the value it always got.
+  const words = [tag ? tag + ' kryptheon test' : 'kryptheon test', 'kryptheon' + tag + '@example.com', 'KN' + (tag || '1'),
+    String(step + 1), 'https://example.com/kryptheon', 'kryptheon' + tag, 'Kryptheon' + tag, 'kn-' + (tag || '1')];
+  const literals = [];
+  for (const definition of definitions) {
+    const quoted = /'((?:[^']|'')*)'/g;
+    let one;
+    while ((one = quoted.exec(definition)) !== null) literals.push(one[1].split("''").join("'"));
+  }
+  const codes = ['US', 'IN', 'USD', 'INR', 'EUR', 'en', 'en-US', '#00000' + d, '2026-01-0' + (1 + (step % 9)), '1234' + d, '56000' + d,
+    'kryptheon test value long enough for a rule on a minimum length ' + (tag || '0')];
+  const name = String(column.name).toLowerCase();
+  const first = /phone|mobile|whatsapp|tel|msisdn/.test(name) ? phones
+    : /mail/.test(name) ? emails
+    : /url|link|website|site|href/.test(name) ? links : [];
+  for (const value of first.concat(words, literals, phones, emails, links, codes)) add(fitTo(value, kind));
+  return out;
+}
+
+/**
+ * The first values a column's CHECK constraints accept, asked of the
+ * database itself: each rule is run on the value alone, the column given as
+ * the value by a one-row subquery. A rule that also names another column
+ * cannot be run alone and is left out; when no rule can be, nothing is
+ * offered and the seeder goes on as before. Remembered per table, column and
+ * row, so the attacks that insert later ask nothing again.
+ *
+ * Returns the accepted values, best first - possibly none.
+ */
+const FITTED = new WeakMap();
+async function fittingValues(client, table, column, distinct) {
+  const definitions = checksOn(table, column.name);
+  if (!definitions.length) return [];
+  const candidates = checkCandidates(column, definitions, distinct);
+  if (!candidates.length) return [];
+  let byTable = FITTED.get(table);
+  if (!byTable) FITTED.set(table, (byTable = new Map()));
+  const key = column.name + '\u0000' + String(distinct);
+  if (byTable.has(key)) return byTable.get(key);
+
+  const type = String(column.type);
+  const alone = (expression, value) =>
+    'SELECT (' + expression + ') IS NOT FALSE AS ok FROM (SELECT ' + value + '::' + type + ' AS ' + quote(column.name) + ') AS kn_row';
+  const runnable = [];
+  for (const expression of definitions) {
+    try {
+      await client.query(alone(expression, 'NULL'));
+      runnable.push(expression);
+    } catch (err) {
+      // Names another column, or something only the table can supply.
+    }
+  }
+  let accepted = [];
+  if (runnable.length) {
+    const all = runnable.map((e) => '(' + e + ') IS NOT FALSE').join(' AND ');
+    for (const value of candidates) {
+      try {
+        const { rows } = await client.query(
+          'SELECT ' + all + ' AS ok FROM (SELECT $1::' + type + ' AS ' + quote(column.name) + ') AS kn_row', [value]);
+        if (rows[0] && rows[0].ok === true) accepted.push(value);
+        // As many as the seeder will ever try; asking further changes nothing.
+        if (accepted.length >= SHAPES_TO_TRY) break;
+      } catch (err) {
+        // A value its own type, or the rule, refuses outright.
+      }
+    }
+  }
+  byTable.set(key, accepted);
+  return accepted;
+}
+
 /**
  * Sets of columns where exactly one may be filled in.
  *
@@ -500,11 +626,14 @@ async function rowFor(client, schema, table, person, distinct, overrides, attemp
     if (column.default_expr) continue;
     if (!column.not_null && !mustFill) continue;
     columns.push(column.name);
-    // A CHECK that lists what it will accept beats anything invented here.
+    // A CHECK that lists what it will accept beats anything invented here;
+    // after that, a value one it could not read was asked about and accepts.
     const allowed = allowedByCheck(table, column.name);
+    const fitting = allowed.length ? [] : await fittingValues(client, table, column, distinct);
+    const pick = (list) => list[Math.min(Math.max(attempt || 0, 0), list.length - 1)];
     values.push(
-      allowed.length
-        ? allowed[Math.min(Math.max(attempt || 0, 0), allowed.length - 1)]
+      allowed.length ? pick(allowed)
+        : fitting.length ? pick(fitting)
         : valueFor(column, person, distinct, attempt),
     );
   }
@@ -531,6 +660,27 @@ function insertRow(client, schema, table, row, back) {
   );
 }
 
+/**
+ * The column that says which organization's a row is, on a table with no
+ * person's name on it - or null. Its first key to a table that others point
+ * at (an organization, a workspace, a team), where the table itself is not one
+ * of those: seeding gives each person their own organization, and a table like
+ * this one row, in the first person's. Found on a blind test (HarborLine):
+ * integration_secrets(organization_id, access_token) was readable by every
+ * signed-in user, and with no person column it was never tried at all.
+ */
+function tenantKey(table, tables, parents) {
+  // A view is not seeded: it shows whatever its tables hold, the second
+  // person's own organization included, so a row of it read by them proves
+  // nothing. Found on the same test: workspace_health, filtered to the
+  // organizations the reader belongs to, came back as a leak.
+  if (table.isView || parents.has(table.name)) return null;
+  for (const key of foreignKeys(table).concat(impliedKeys(table, tables))) {
+    if (key.refTable !== table.name && parents.has(key.refTable) && key.columns.length === 1) return key.columns[0];
+  }
+  return null;
+}
+
 /** Every table some other table points at, by a key it declared or one it implies. */
 function parentTables(tables) {
   const parents = new Set();
@@ -619,7 +769,19 @@ async function seed(client, schema, tables) {
       // this table can use the same one instead of rediscovering it, and be
       // sure a refusal is the app defending itself rather than a CHECK it
       // never satisfied.
-      seeded.push({ table: table.name, owner: owner, attempt: worked });
+      const entry = { table: table.name, owner: owner, attempt: worked };
+      // A table with nobody's name on it that got a row for each person - an
+      // organization's invoices, say - holds the second person's own row too.
+      // Which row is the first person's is kept, so a write meant for
+      // "somebody else's row" is aimed at it. Found on a blind test
+      // (HarborLine): an unscoped UPDATE changed the second person's own
+      // invoice, and was reported as any customer changing another's.
+      const firstRow = !owner && rows.get(table.name) && rows.get(table.name).get(USER_A);
+      const pk = primaryKeyOf(table);
+      if (firstRow && rows.get(table.name).size === 2 && pk && firstRow[pk] !== null && firstRow[pk] !== undefined) {
+        entry.rowOfA = { column: pk, value: String(firstRow[pk]) };
+      }
+      seeded.push(entry);
     } else {
       // Recorded, never swallowed. The report has to say this table was not
       // checked rather than let an empty table pass for a safe one.
@@ -747,8 +909,10 @@ async function impersonate(client, schema, tables) {
     return false;
   };
 
+  const parents = parentTables(tables);
   for (const table of tables) {
     const owner = ownerColumn(table);
+    const tenant = owner ? null : tenantKey(table, tables, parents);
     const anon = await readAs(client, schema, table.name, 'anon', null);
     const asA = await readAs(client, schema, table.name, 'authenticated', USER_A);
 
@@ -794,6 +958,27 @@ async function impersonate(client, schema, tables) {
         });
       }
     }
+
+    // A table whose rows are an organization's, not a person's: its one row is
+    // the first person's organization's, and the second person - signed in,
+    // in an organization of their own - asks for it. What a logged-out
+    // stranger can already read is reported as exposed, and not twice.
+    if (tenant) {
+      const asB = await readAs(client, schema, table.name, 'authenticated', USER_B);
+      const open = Array.isArray(anon) && anon.length > 0;
+      if (settle('crossed:' + table.name, table.name, asB, 'as a signed-in user in another organization') &&
+          asB.length > 0 && !open) {
+        findings.push({
+          kind: 'crossed',
+          table: table.name,
+          owner: tenant,
+          tenant: true,
+          readable: asB.length,
+          columns: Object.keys(asB[0] || {}),
+          rlsEnabled: table.rlsEnabled,
+        });
+      }
+    }
   }
 
   return { findings: findings, completed: completed, blocked: blocked, looped: looped };
@@ -826,6 +1011,9 @@ module.exports = {
   dependencyOrder: dependencyOrder,
   valueFor: valueFor,
   allowedByCheck: allowedByCheck,
+  checksOn: checksOn,
+  checkCandidates: checkCandidates,
+  fittingValues: fittingValues,
   exactlyOne: exactlyOne,
   rowFor: rowFor,
   existingRow: existingRow,

package/collision.js

@@ -214,7 +214,12 @@ async function collide(client, one, two, schema, tables, indexes) {
 
   for (const target of candidates(tables, indexes)) {
     const table = byName.get(target.table);
-    const value = collidingValue(target);
+    // A column with a CHECK of its own - an email that has to look like one -
+    // refused the made-up value, and the race never started. A value the
+    // rule was asked about and accepts is raced instead.
+    const column = table && (table.columns || []).find((c) => c.name === target.column);
+    const fitting = column ? await attack.fittingValues(client, table, column, 'collision') : [];
+    const value = fitting.length ? fitting[0] : collidingValue(target);
     const override = {};
     override[target.column] = value;