kryptheon-night 0.1.32 → 0.1.33

package/attack.js

@@ -204,6 +204,132 @@ function allowedByCheck(table, columnName) {
   return found;
 }
 
+/**
+ * The CHECK constraints on a table that name this column, as the expression
+ * inside CHECK (...). A NOT VALID one still applies to every new row.
+ */
+function checksOn(table, columnName) {
+  const escaped = String(columnName).replace(/[.*+?^${}()|[\]\\]/g, '\\$&');
+  const named = new RegExp('(^|[^A-Za-z0-9_$"])("' + escaped.split('"').join('""') + '"|' + escaped + ')($|[^A-Za-z0-9_$"])');
+  const found = [];
+  for (const constraint of table.constraints || []) {
+    if (constraint.kind !== 'c') continue;
+    const definition = String(constraint.definition || '');
+    if (!named.test(definition)) continue;
+    found.push(definition.replace(/^CHECK\s*/i, '').replace(/\s+NOT VALID\s*$/i, ''));
+  }
+  return found;
+}
+
+const NUMERIC_KIND = /^(integer|bigint|smallint|numeric|decimal|real|double)/;
+const TEXT_KIND = /^(text|character|varchar|citext)/;
+
+/**
+ * Values to offer a column whose CHECK could not be read, best first.
+ *
+ * Found on a real app (a clinic's, 2026-10-11): patient_waitlist and
+ * whatsapp_contacts each had a phone number column with a CHECK on its
+ * format, compliance_requests a type column with a CHECK no reading here
+ * understood - and none of the made-up values fitted, so three tables, and a
+ * fourth that pointed at one of them, were never tested. Nothing here reads
+ * the rule. Each value is put to the rule itself, in the database
+ * (fittingValue), and the first it accepts is used.
+ *
+ * Mirrored by __KN__.check_candidates in engine.sql, value for value and in
+ * the same order: both engines must seed the same rows.
+ */
+function checkCandidates(column, definitions, distinct) {
+  const kind = String(column.base_type || column.type).toLowerCase();
+  const tag = distinct === undefined || distinct === null ? '' : String(distinct);
+  const step = Number(tag) || 0;
+  const out = [];
+  const add = (value) => { if (out.indexOf(value) === -1) out.push(value); };
+  if (NUMERIC_KIND.test(kind)) {
+    [1 + step, 18 + step, 100 + step, 1000 + step, 0, 5].forEach((n) => add(String(n)));
+    for (const definition of definitions) {
+      const numbers = definition.match(/-?\d+(?:\.\d+)?/g) || [];
+      numbers.forEach(add);
+    }
+    return out;
+  }
+  if (!TEXT_KIND.test(kind)) return out;
+  const d = String(step % 10);
+  const phones = ['+1415555012' + d, '+919876543' + (210 + step), '9876543' + (210 + step), '415555012' + d,
+    '+1 415-555-012' + d, '(415) 555-012' + d, '415-555-012' + d, '+44 7700 90012' + d, '07700 90012' + d];
+  const emails = ['kryptheon' + tag + '@example.com'];
+  const links = ['https://example.com/kryptheon' + tag];
+  // The shapes valueFor offers, in its order, so a rule they already passed
+  // still gets the value it always got.
+  const words = [tag ? tag + ' kryptheon test' : 'kryptheon test', 'kryptheon' + tag + '@example.com', 'KN' + (tag || '1'),
+    String(step + 1), 'https://example.com/kryptheon', 'kryptheon' + tag, 'Kryptheon' + tag, 'kn-' + (tag || '1')];
+  const literals = [];
+  for (const definition of definitions) {
+    const quoted = /'((?:[^']|'')*)'/g;
+    let one;
+    while ((one = quoted.exec(definition)) !== null) literals.push(one[1].split("''").join("'"));
+  }
+  const codes = ['US', 'IN', 'USD', 'INR', 'EUR', 'en', 'en-US', '#00000' + d, '2026-01-0' + (1 + (step % 9)), '1234' + d, '56000' + d,
+    'kryptheon test value long enough for a rule on a minimum length ' + (tag || '0')];
+  const name = String(column.name).toLowerCase();
+  const first = /phone|mobile|whatsapp|tel|msisdn/.test(name) ? phones
+    : /mail/.test(name) ? emails
+    : /url|link|website|site|href/.test(name) ? links : [];
+  for (const value of first.concat(words, literals, phones, emails, links, codes)) add(fitTo(value, kind));
+  return out;
+}
+
+/**
+ * The first values a column's CHECK constraints accept, asked of the
+ * database itself: each rule is run on the value alone, the column given as
+ * the value by a one-row subquery. A rule that also names another column
+ * cannot be run alone and is left out; when no rule can be, nothing is
+ * offered and the seeder goes on as before. Remembered per table, column and
+ * row, so the attacks that insert later ask nothing again.
+ *
+ * Returns the accepted values, best first - possibly none.
+ */
+const FITTED = new WeakMap();
+async function fittingValues(client, table, column, distinct) {
+  const definitions = checksOn(table, column.name);
+  if (!definitions.length) return [];
+  const candidates = checkCandidates(column, definitions, distinct);
+  if (!candidates.length) return [];
+  let byTable = FITTED.get(table);
+  if (!byTable) FITTED.set(table, (byTable = new Map()));
+  const key = column.name + '\u0000' + String(distinct);
+  if (byTable.has(key)) return byTable.get(key);
+
+  const type = String(column.type);
+  const alone = (expression, value) =>
+    'SELECT (' + expression + ') IS NOT FALSE AS ok FROM (SELECT ' + value + '::' + type + ' AS ' + quote(column.name) + ') AS kn_row';
+  const runnable = [];
+  for (const expression of definitions) {
+    try {
+      await client.query(alone(expression, 'NULL'));
+      runnable.push(expression);
+    } catch (err) {
+      // Names another column, or something only the table can supply.
+    }
+  }
+  let accepted = [];
+  if (runnable.length) {
+    const all = runnable.map((e) => '(' + e + ') IS NOT FALSE').join(' AND ');
+    for (const value of candidates) {
+      try {
+        const { rows } = await client.query(
+          'SELECT ' + all + ' AS ok FROM (SELECT $1::' + type + ' AS ' + quote(column.name) + ') AS kn_row', [value]);
+        if (rows[0] && rows[0].ok === true) accepted.push(value);
+        // As many as the seeder will ever try; asking further changes nothing.
+        if (accepted.length >= SHAPES_TO_TRY) break;
+      } catch (err) {
+        // A value its own type, or the rule, refuses outright.
+      }
+    }
+  }
+  byTable.set(key, accepted);
+  return accepted;
+}
+
 /**
  * Sets of columns where exactly one may be filled in.
  *
@@ -500,11 +626,14 @@ async function rowFor(client, schema, table, person, distinct, overrides, attemp
     if (column.default_expr) continue;
     if (!column.not_null && !mustFill) continue;
     columns.push(column.name);
-    // A CHECK that lists what it will accept beats anything invented here.
+    // A CHECK that lists what it will accept beats anything invented here;
+    // after that, a value one it could not read was asked about and accepts.
     const allowed = allowedByCheck(table, column.name);
+    const fitting = allowed.length ? [] : await fittingValues(client, table, column, distinct);
+    const pick = (list) => list[Math.min(Math.max(attempt || 0, 0), list.length - 1)];
     values.push(
-      allowed.length
-        ? allowed[Math.min(Math.max(attempt || 0, 0), allowed.length - 1)]
+      allowed.length ? pick(allowed)
+        : fitting.length ? pick(fitting)
         : valueFor(column, person, distinct, attempt),
     );
   }
@@ -882,6 +1011,9 @@ module.exports = {
   dependencyOrder: dependencyOrder,
   valueFor: valueFor,
   allowedByCheck: allowedByCheck,
+  checksOn: checksOn,
+  checkCandidates: checkCandidates,
+  fittingValues: fittingValues,
   exactlyOne: exactlyOne,
   rowFor: rowFor,
   existingRow: existingRow,

package/collision.js

@@ -214,7 +214,12 @@ async function collide(client, one, two, schema, tables, indexes) {
 
   for (const target of candidates(tables, indexes)) {
     const table = byName.get(target.table);
-    const value = collidingValue(target);
+    // A column with a CHECK of its own - an email that has to look like one -
+    // refused the made-up value, and the race never started. A value the
+    // rule was asked about and accepts is raced instead.
+    const column = table && (table.columns || []).find((c) => c.name === target.column);
+    const fitting = column ? await attack.fittingValues(client, table, column, 'collision') : [];
+    const value = fitting.length ? fitting[0] : collidingValue(target);
     const override = {};
     override[target.column] = value;
 

package/engine.sql

@@ -1464,6 +1464,155 @@ BEGIN
   RETURN found;
 END $$;
 
+/*
+ * The CHECK constraints on a table that name this column, as the expression
+ * inside CHECK (...). A NOT VALID one still applies to every new row.
+ * Mirrors checksOn in attack.js.
+ */
+CREATE OR REPLACE FUNCTION __KN__.checks_on(tab jsonb, column_name text)
+RETURNS text[] LANGUAGE plpgsql IMMUTABLE AS $$
+DECLARE
+  escaped text := regexp_replace(column_name, '([.*+?^${}()|\[\]\\])', '\\\1', 'g');
+  named text;
+  found text[] := ARRAY[]::text[];
+  con jsonb;
+  definition text;
+BEGIN
+  named := '(^|[^A-Za-z0-9_$"])("' || replace(escaped, '"', '""') || '"|' || escaped || ')($|[^A-Za-z0-9_$"])';
+  FOR con IN SELECT * FROM jsonb_array_elements(coalesce(tab->'constraints', '[]'::jsonb)) LOOP
+    CONTINUE WHEN con->>'kind' <> 'c';
+    definition := coalesce(con->>'definition', '');
+    CONTINUE WHEN definition !~ named;
+    found := found || regexp_replace(regexp_replace(definition, '^CHECK\s*', '', 'i'), '\s+NOT VALID\s*$', '', 'i');
+  END LOOP;
+  RETURN found;
+END $$;
+
+/*
+ * Values to offer a column whose CHECK could not be read, best first.
+ *
+ * Found on a real app (a clinic's, 2026-10-11): phone number columns with a
+ * CHECK on their format, and a type column with a CHECK nothing here read -
+ * three tables, and a fourth that pointed at one of them, never tested.
+ * Nothing here reads the rule: each value is put to the rule itself
+ * (fitting_values), and the first it accepts is used.
+ *
+ * Mirrors checkCandidates in attack.js, value for value and in the same
+ * order: both engines must seed the same rows.
+ */
+CREATE OR REPLACE FUNCTION __KN__.check_candidates(col jsonb, definitions text[], distinct_ text)
+RETURNS text[] LANGUAGE plpgsql IMMUTABLE AS $$
+DECLARE
+  kind text := lower(coalesce(col->>'base_type', col->>'type'));
+  tag text := coalesce(distinct_, '');
+  step integer := CASE WHEN coalesce(distinct_, '') ~ '^[0-9]+$' THEN distinct_::integer ELSE 0 END;
+  d text;
+  name_ text := lower(col->>'name');
+  out_ text[] := ARRAY[]::text[];
+  phones text[];
+  emails text[];
+  links text[];
+  words text[];
+  literals text[] := ARRAY[]::text[];
+  codes text[];
+  first_ text[] := ARRAY[]::text[];
+  definition text;
+  one text;
+  value_ text;
+BEGIN
+  IF kind ~ '^(integer|bigint|smallint|numeric|decimal|real|double)' THEN
+    FOREACH value_ IN ARRAY ARRAY[(1 + step)::text, (18 + step)::text, (100 + step)::text, (1000 + step)::text, '0', '5'] LOOP
+      IF NOT (value_ = ANY (out_)) THEN out_ := out_ || value_; END IF;
+    END LOOP;
+    FOREACH definition IN ARRAY coalesce(definitions, ARRAY[]::text[]) LOOP
+      FOR one IN SELECT (m)[1] FROM regexp_matches(definition, '(-?\d+(?:\.\d+)?)', 'g') m LOOP
+        IF NOT (one = ANY (out_)) THEN out_ := out_ || one; END IF;
+      END LOOP;
+    END LOOP;
+    RETURN out_;
+  END IF;
+  IF kind !~ '^(text|character|varchar|citext)' THEN RETURN out_; END IF;
+  d := (step % 10)::text;
+  phones := ARRAY['+1415555012' || d, '+919876543' || (210 + step)::text, '9876543' || (210 + step)::text, '415555012' || d,
+    '+1 415-555-012' || d, '(415) 555-012' || d, '415-555-012' || d, '+44 7700 90012' || d, '07700 90012' || d];
+  emails := ARRAY['kryptheon' || tag || '@example.com'];
+  links := ARRAY['https://example.com/kryptheon' || tag];
+  -- The shapes value_for offers, in its order, so a rule they already passed
+  -- still gets the value it always got.
+  words := ARRAY[CASE WHEN tag <> '' THEN tag || ' kryptheon test' ELSE 'kryptheon test' END,
+    'kryptheon' || tag || '@example.com', 'KN' || CASE WHEN tag <> '' THEN tag ELSE '1' END,
+    (step + 1)::text, 'https://example.com/kryptheon', 'kryptheon' || tag, 'Kryptheon' || tag,
+    'kn-' || CASE WHEN tag <> '' THEN tag ELSE '1' END];
+  FOREACH definition IN ARRAY coalesce(definitions, ARRAY[]::text[]) LOOP
+    FOR one IN SELECT (m)[1] FROM regexp_matches(definition, '''((?:[^'']|'''')*)''', 'g') m LOOP
+      literals := literals || replace(one, '''''', '''');
+    END LOOP;
+  END LOOP;
+  codes := ARRAY['US', 'IN', 'USD', 'INR', 'EUR', 'en', 'en-US', '#00000' || d, '2026-01-0' || (1 + (step % 9))::text,
+    '1234' || d, '56000' || d,
+    'kryptheon test value long enough for a rule on a minimum length ' || CASE WHEN tag <> '' THEN tag ELSE '0' END];
+  IF name_ ~ 'phone|mobile|whatsapp|tel|msisdn' THEN first_ := phones;
+  ELSIF name_ ~ 'mail' THEN first_ := emails;
+  ELSIF name_ ~ 'url|link|website|site|href' THEN first_ := links;
+  END IF;
+  FOREACH value_ IN ARRAY first_ || words || literals || phones || emails || links || codes LOOP
+    value_ := __KN__.fit_to(value_, kind);
+    IF NOT (value_ = ANY (out_)) THEN out_ := out_ || value_; END IF;
+  END LOOP;
+  RETURN out_;
+END $$;
+
+/*
+ * The first values a column's CHECK constraints accept, asked of the
+ * database itself: each rule is run on the value alone, the column given as
+ * the value by a one-row subquery. A rule that also names another column
+ * cannot be run alone and is left out; when no rule can be, nothing is
+ * offered and the seeder goes on as before. At most five - as many as the
+ * seeder ever tries. Mirrors fittingValues in attack.js.
+ */
+CREATE OR REPLACE FUNCTION __KN__.fitting_values(tab jsonb, col jsonb, distinct_ text)
+RETURNS text[] LANGUAGE plpgsql AS $$
+DECLARE
+  name_ text := col->>'name';
+  type_ text := col->>'type';
+  definitions text[] := __KN__.checks_on(tab, col->>'name');
+  candidates text[];
+  runnable text[] := ARRAY[]::text[];
+  all_ text;
+  accepted text[] := ARRAY[]::text[];
+  expression text;
+  value_ text;
+  ok boolean;
+BEGIN
+  IF coalesce(array_length(definitions, 1), 0) = 0 THEN RETURN accepted; END IF;
+  candidates := __KN__.check_candidates(col, definitions, distinct_);
+  IF coalesce(array_length(candidates, 1), 0) = 0 THEN RETURN accepted; END IF;
+  FOREACH expression IN ARRAY definitions LOOP
+    BEGIN
+      EXECUTE format('SELECT (%s) IS NOT FALSE AS ok FROM (SELECT NULL::%s AS %I) AS kn_row', expression, type_, name_);
+      runnable := runnable || expression;
+    EXCEPTION WHEN OTHERS THEN
+      -- Names another column, or something only the table can supply.
+      NULL;
+    END;
+  END LOOP;
+  IF coalesce(array_length(runnable, 1), 0) = 0 THEN RETURN accepted; END IF;
+  SELECT string_agg('(' || e || ') IS NOT FALSE', ' AND ') INTO all_ FROM unnest(runnable) e;
+  FOREACH value_ IN ARRAY candidates LOOP
+    BEGIN
+      EXECUTE format('SELECT %s AS ok FROM (SELECT $1::%s AS %I) AS kn_row', all_, type_, name_) INTO ok USING value_;
+      IF ok IS TRUE THEN
+        accepted := accepted || value_;
+        EXIT WHEN array_length(accepted, 1) >= 5;
+      END IF;
+    EXCEPTION WHEN OTHERS THEN
+      -- A value its own type, or the rule, refuses outright.
+      NULL;
+    END;
+  END LOOP;
+  RETURN accepted;
+END $$;
+
 /*
  * Something valid to put in a column, so a row can exist at all.
  *
@@ -1983,8 +2132,12 @@ BEGIN
     CONTINUE WHEN NOT (col->>'not_null')::boolean AND NOT must_fill;
 
     columns := columns || to_jsonb(name);
-    -- A CHECK that lists what it will accept beats anything invented here.
+    -- A CHECK that lists what it will accept beats anything invented here;
+    -- after that, a value one it could not read was asked about and accepts.
     allowed := __KN__.allowed_by_check(tab, name);
+    IF coalesce(array_length(allowed, 1), 0) = 0 THEN
+      allowed := __KN__.fitting_values(tab, col, distinct_);
+    END IF;
     IF array_length(allowed, 1) > 0 THEN
       nth := least(greatest(coalesce(attempt, 0), 0), array_length(allowed, 1) - 1);
       values_ := values_ || jsonb_build_array(to_jsonb(allowed[nth + 1]));

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "kryptheon-night",
-  "version": "0.1.32",
+  "version": "0.1.33",
   "description": "Attacks a copy of your Supabase database and tells you in plain English what got in.",
   "license": "MIT",
   "type": "commonjs",
@@ -31,7 +31,7 @@
     "node": ">=18.0.0"
   },
   "scripts": {
-    "check": "node package.check.js && node store.check.js && node trouble.check.js && node intro.check.js && node finding.check.js && node outside.check.js && node recheck.check.js && node untouched.check.js && node blocked.check.js && node orphans.check.js && node guests.check.js && node usable.check.js && node twin.check.js && node engines.check.js && node external.check.js && node schema.check.js && node collision.check.js && node tamper.check.js && node orphan.check.js && node shapes.check.js && node verdicts.check.js && node shop.check.js && node privileged.check.js && node recursion.check.js && node guarded.check.js && node nightly.check.js && node words.check.js && node helpers.check.js && node deeploop.check.js && node teams.check.js && node roles.check.js && node buckets.check.js && node cli.check.js && node loop.check.js && node report.check.js && node installscript.check.js && node tenants.check.js && node takeover.check.js",
+    "check": "node package.check.js && node store.check.js && node trouble.check.js && node intro.check.js && node finding.check.js && node outside.check.js && node recheck.check.js && node untouched.check.js && node blocked.check.js && node orphans.check.js && node guests.check.js && node usable.check.js && node twin.check.js && node engines.check.js && node external.check.js && node schema.check.js && node collision.check.js && node tamper.check.js && node orphan.check.js && node shapes.check.js && node verdicts.check.js && node shop.check.js && node privileged.check.js && node recursion.check.js && node guarded.check.js && node nightly.check.js && node words.check.js && node helpers.check.js && node deeploop.check.js && node teams.check.js && node roles.check.js && node buckets.check.js && node cli.check.js && node loop.check.js && node report.check.js && node installscript.check.js && node tenants.check.js && node takeover.check.js && node checkfit.check.js",
     "check:dry": "node package.check.js && node store.check.js && node trouble.check.js && node intro.check.js && node finding.check.js && node recheck.check.js && node outside.check.js",
     "check:package": "node package.check.js",
     "check:store": "node store.check.js",
@@ -77,7 +77,8 @@
     "check:buckets": "node buckets.check.js",
     "check:installscript": "node installscript.check.js",
     "check:tenants": "node tenants.check.js",
-    "check:takeover": "node takeover.check.js"
+    "check:takeover": "node takeover.check.js",
+    "check:checkfit": "node checkfit.check.js"
   },
   "keywords": [
     "supabase",