kryptheon-night 0.1.36 → 0.1.37

package/engine.sql

@@ -261,6 +261,9 @@ RETURNS jsonb LANGUAGE sql STABLE AS $$
                'def', pg_get_functiondef(p.oid),
                'args', pg_get_function_identity_arguments(p.oid),
                'default_acl', p.proacl IS NULL,
+               -- Installed by an extension, not written by the app (schema.js readFunctions).
+               'from_extension', EXISTS (SELECT 1 FROM pg_depend d
+                                          WHERE d.classid = 'pg_proc'::regclass AND d.objid = p.oid AND d.deptype = 'e'),
                -- Whether the app can call it at all (schema.js readFunctions).
                'client_callable', CASE WHEN EXISTS (SELECT 1 FROM pg_roles WHERE rolname = 'anon')
                                             AND EXISTS (SELECT 1 FROM pg_roles WHERE rolname = 'authenticated')
@@ -3954,6 +3957,35 @@ BEGIN
   RETURN out_;
 END $$;
 
+/* The tables whose rules decide who is asking from a setting the app's own
+   server sets - current_setting('app.tenant_id') - not from a Supabase
+   sign-in: NOT checked, said with the settings (scan.js serverIdentityOf,
+   blind round 13). */
+CREATE OR REPLACE FUNCTION __KN__.server_identity(plan jsonb)
+RETURNS jsonb LANGUAGE sql IMMUTABLE AS $$
+  WITH texts AS (
+    SELECT p->>'table_name' AS t, coalesce(p->>'qual', '') || ' ' || coalesce(p->>'with_check', '') AS x
+      FROM jsonb_array_elements(coalesce(plan->'policies', '[]'::jsonb)) p
+  ), settings AS (
+    SELECT t, (regexp_matches(x, 'current_setting\s*\(\s*''([^'']+)''', 'gi'))[1] AS s
+      FROM texts
+     WHERE x !~* '\mauth\s*\.\s*(uid|jwt|role|email)\s*\(|request\.jwt'
+  ), per AS (
+    SELECT t, array_agg(DISTINCT 'current_setting(''' || s || ''')' ORDER BY 'current_setting(''' || s || ''')') AS q
+      FROM settings
+     WHERE s !~* '^request\.'
+     GROUP BY t
+  )
+  SELECT coalesce(jsonb_agg(jsonb_build_object(
+           'table', t,
+           'why', 'its rules decide who is asking with '
+                  || CASE WHEN cardinality(q) < 2 THEN q[1]
+                          ELSE array_to_string(q[1:cardinality(q) - 1], ', ') || ' and ' || q[cardinality(q)] END,
+           'identity', true)
+         ORDER BY t COLLATE "C"), '[]'::jsonb)
+    FROM per;
+$$;
+
 /* The app's functions read and never called (scan.js notCalledOf). */
 CREATE OR REPLACE FUNCTION __KN__.not_called(plan jsonb, findings jsonb)
 RETURNS jsonb LANGUAGE sql IMMUTABLE AS $$
@@ -3966,6 +3998,7 @@ RETURNS jsonb LANGUAGE sql IMMUTABLE AS $$
   SELECT coalesce(jsonb_agg(DISTINCT (fn->>'name') COLLATE "C" ORDER BY (fn->>'name') COLLATE "C"), '[]'::jsonb)
     FROM jsonb_array_elements(coalesce(plan->'functions', '[]'::jsonb)) fn, rules
    WHERE coalesce((fn->>'client_callable')::boolean, false)
+     AND NOT coalesce((fn->>'from_extension')::boolean, false)
      AND (fn->>'name') NOT IN (SELECT name FROM named)
      AND NOT __KN__.calls_function(rules.text_, fn->>'name');
 $$;
@@ -4121,6 +4154,7 @@ BEGIN
     -- And everything that was not. Said out loud, never left out: a table
     -- nothing could be put into reads exactly like a table nothing got out of.
     not_checked := coalesce(sown->'skipped', '[]'::jsonb)
+                || __KN__.server_identity(plan)
                 || coalesce(seen->'blocked', '[]'::jsonb)
                 || coalesce(wrote->'blocked', '[]'::jsonb)
                 || coalesce(ranked->'blocked', '[]'::jsonb)

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "kryptheon-night",
-  "version": "0.1.36",
+  "version": "0.1.37",
   "description": "Attacks a copy of your Supabase database and tells you in plain English what got in.",
   "license": "SEE LICENSE IN LICENSE",
   "type": "commonjs",
@@ -31,7 +31,7 @@
     "node": ">=18.0.0"
   },
   "scripts": {
-    "check": "node package.check.js && node store.check.js && node trouble.check.js && node intro.check.js && node finding.check.js && node outside.check.js && node recheck.check.js && node untouched.check.js && node blocked.check.js && node orphans.check.js && node guests.check.js && node usable.check.js && node twin.check.js && node engines.check.js && node external.check.js && node schema.check.js && node collision.check.js && node tamper.check.js && node orphan.check.js && node shapes.check.js && node verdicts.check.js && node shop.check.js && node privileged.check.js && node recursion.check.js && node guarded.check.js && node nightly.check.js && node words.check.js && node helpers.check.js && node deeploop.check.js && node teams.check.js && node roles.check.js && node buckets.check.js && node cli.check.js && node loop.check.js && node report.check.js && node installscript.check.js && node tenants.check.js && node takeover.check.js && node checkfit.check.js && node declared.check.js",
+    "check": "node package.check.js && node store.check.js && node trouble.check.js && node intro.check.js && node finding.check.js && node outside.check.js && node recheck.check.js && node untouched.check.js && node blocked.check.js && node orphans.check.js && node guests.check.js && node usable.check.js && node twin.check.js && node engines.check.js && node external.check.js && node schema.check.js && node collision.check.js && node tamper.check.js && node orphan.check.js && node shapes.check.js && node verdicts.check.js && node shop.check.js && node privileged.check.js && node recursion.check.js && node guarded.check.js && node nightly.check.js && node words.check.js && node helpers.check.js && node deeploop.check.js && node teams.check.js && node roles.check.js && node buckets.check.js && node cli.check.js && node loop.check.js && node report.check.js && node installscript.check.js && node tenants.check.js && node takeover.check.js && node checkfit.check.js && node declared.check.js && node identity.check.js",
     "check:dry": "node package.check.js && node store.check.js && node trouble.check.js && node intro.check.js && node finding.check.js && node recheck.check.js && node outside.check.js",
     "check:package": "node package.check.js",
     "check:store": "node store.check.js",
@@ -78,7 +78,8 @@
     "check:installscript": "node installscript.check.js",
     "check:tenants": "node tenants.check.js",
     "check:takeover": "node takeover.check.js",
-    "check:checkfit": "node checkfit.check.js"
+    "check:checkfit": "node checkfit.check.js",
+    "check:identity": "node identity.check.js"
   },
   "keywords": [
     "supabase",

package/scan.js

@@ -285,7 +285,7 @@ async function scan(client, sourceSchema, options) {
     // Surfaced, not swallowed. A table with no row in it reads as a safe
     // table, so the one thing that must never happen is reporting an app as
     // clear when part of it was never actually tried.
-    const notChecked = sown.skipped.slice();
+    const notChecked = sown.skipped.slice().concat(serverIdentityOf(plan));
 
     // A read that errored for any reason other than the table being closed to
     // that role decided nothing at all, and zero rows back from a failed query
@@ -693,6 +693,44 @@ async function conflictsIn(client, into, plan, indexes) {
   return found;
 }
 
+/**
+ * The tables whose rules decide who is asking from a setting the app's own
+ * server sets - current_setting('app.tenant_id') - rather than from a
+ * Supabase sign-in. Each is a table NOT checked, said with the settings.
+ *
+ * Found on blind round 13 (Northstar Ops, Express on plain Postgres): every
+ * rule read app.tenant_id / app.user_id, which nothing here sets. Every attack
+ * ran as nobody, every one was refused for that reason alone, and the report
+ * said "Nothing got through" over a table whose rule was USING (true) - the
+ * one sentence this program must never print by accident. A rule that also
+ * asks Supabase (auth.uid(), request.jwt...) is attacked as usual.
+ * Mirrors server_identity in engine.sql.
+ */
+function serverIdentityOf(plan) {
+  const byTable = new Map();
+  for (const p of (plan && plan.policies) || []) {
+    const text = String(p.qual || '') + ' ' + String(p.with_check || '');
+    if (/\bauth\s*\.\s*(uid|jwt|role|email)\s*\(|request\.jwt/i.test(text)) continue;
+    const re = /current_setting\s*\(\s*'([^']+)'/gi;
+    let m;
+    while ((m = re.exec(text))) {
+      if (/^request\./i.test(m[1])) continue;
+      if (!byTable.has(p.table_name)) byTable.set(p.table_name, new Set());
+      byTable.get(p.table_name).add(m[1]);
+    }
+  }
+  return Array.from(byTable.keys()).sort().map((table) => {
+    const settings = Array.from(byTable.get(table)).sort();
+    // The why is short and per table; what it means is said once, under the
+    // list (notTestedLines), not repeated for every table.
+    return {
+      table: table,
+      why: 'its rules decide who is asking with ' + andList(settings.map((s) => "current_setting('" + s + "')")),
+      identity: true,
+    };
+  });
+}
+
 /**
  * The app's functions that were read and never called: anything a visitor or
  * a signed-in user can call, that no rule calls for them (those ran with every
@@ -707,7 +745,7 @@ function notCalledOf(plan, findings) {
   const rules = ((plan && plan.policies) || []).map((p) => String(p.qual || '') + ' ' + String(p.with_check || '')).join(' ');
   const named = new Set((findings || []).map((f) => f.fn).filter(Boolean));
   const names = ((plan && plan.functions) || [])
-    .filter((fn) => fn.client_callable === true && !named.has(fn.name))
+    .filter((fn) => fn.client_callable === true && fn.from_extension !== true && !named.has(fn.name))
     .map((fn) => fn.name)
     .filter((name) => !new RegExp('(^|[^A-Za-z0-9_$])"?' + escape(name) + '"?\\s*\\(').test(rules));
   return Array.from(new Set(names)).sort();
@@ -915,8 +953,17 @@ function notTestedLines(result) {
     lines.push('    Every table I could reach was attacked, and every attack I have');
     lines.push('    finished, ran.');
   } else {
+    // Wrapped: a reason can be a sentence or two (serverIdentityOf), and an
+    // unwrapped one ran off the side of the terminal and the dashboard.
     for (const missed of notChecked) {
-      lines.push('    ' + missed.table + ' - ' + missed.why);
+      wrap(missed.table + ' - ' + missed.why, 66).forEach((l, i) => lines.push((i ? '      ' : '    ') + l));
+    }
+    if (notChecked.some((missed) => missed.identity)) {
+      lines.push('');
+      wrap('Those settings are set by your own server, not by a Supabase sign-in. I sign in the way Supabase ' +
+        'does, so every attack on those tables ran as nobody, and being refused proves nothing about them. ' +
+        'Check those rules by hand, or test them with your server setting who is asking.', 66)
+        .forEach((l) => lines.push('    ' + l));
     }
     lines.push('');
     lines.push('    These are unknown, not clear. An attack that never ran comes back');
@@ -1201,6 +1248,7 @@ module.exports = {
   partialWhereFor: partialWhereFor,
   conflictsIn: conflictsIn,
   notCalledOf: notCalledOf,
+  serverIdentityOf: serverIdentityOf,
   bucketsOf: bucketsOf,
   loopingTables: loopingTables,
   taggerFor: taggerFor,

package/schema.js

@@ -387,6 +387,11 @@ async function readFunctions(client, schema) {
             pg_get_functiondef(p.oid) AS def,
             pg_get_function_identity_arguments(p.oid) AS args,
             p.proacl IS NULL AS default_acl,
+            -- Installed by an extension (pgcrypto's crypt(), digest() ...):
+            -- not something the app wrote, so never listed as "your app's
+            -- functions" (blind round 13 listed 23 of pgcrypto's).
+            EXISTS (SELECT 1 FROM pg_depend d
+                     WHERE d.classid = 'pg_proc'::regclass AND d.objid = p.oid AND d.deptype = 'e') AS from_extension,
             -- Whether the app can call it at all, as a visitor or signed in.
             -- Such a function is something the app does that was read and
             -- never run - said under "What I did not test" (scan.js notCalledOf).