kryptheon-night 0.1.38 → 0.1.39

package/engine.sql

@@ -393,7 +393,7 @@ END $$;
  * and the first RETURN). `helpers` are { name, nullable } - a yes/no about
  * the caller, or a role helper that answers NULL for a stranger.
  */
-CREATE OR REPLACE FUNCTION __KN__.door_of(body text, helpers jsonb)
+CREATE OR REPLACE FUNCTION __KN__.door_of(body text, helpers jsonb, args text DEFAULT NULL)
 RETURNS jsonb LANGUAGE plpgsql IMMUTABLE AS $$
 DECLARE
   text_ text := coalesce(body, '');
@@ -411,6 +411,16 @@ DECLARE
   h jsonb;
   asks boolean;
   slips boolean := false;
+  -- schema.js namesSomebody: an argument that could point at somebody else's
+  -- row. With none, "is anybody signed in" turns away everyone it needs to.
+  names_somebody boolean := args IS NULL OR EXISTS (
+    SELECT 1 FROM unnest(string_to_array(args, ',')) a(raw),
+         LATERAL (SELECT regexp_split_to_array(btrim(regexp_replace(btrim(a.raw), '^(in|inout|variadic)\s+', '', 'i')), '\s+') AS w) p
+     WHERE btrim(a.raw) <> '' AND (
+       array_to_string(CASE WHEN array_length(p.w, 1) > 1 THEN p.w[2:] ELSE p.w END, ' ')
+         ~* '\y(uuid|oid|int[248]?|integer|bigint|smallint|numeric|serial|bigserial)\y'
+       OR (array_length(p.w, 1) > 1 AND replace(p.w[1], '"', '')
+         ~* '(^|_)(ids?|uids?|orgs?|organizations?|tenants?|teams?|workspaces?|accounts?|users?|owners?|members?|projects?|customers?|compan(y|ies))$')));
 BEGIN
   IF text_ ~* writes_re THEN
     first_act := least(first_act, length((regexp_split_to_array(text_, writes_re, 'i'))[1]) + 1);
@@ -440,6 +450,10 @@ BEGIN
     IF refuses_on_no AND cond ~* '\yauth\s*\.\s*(uid|jwt)\s*\(' AND cond ~* 'admin|owner|member|role' THEN
       RETURN jsonb_build_object('guarded', true, 'nullSlips', false);
     END IF;
+    IF NOT names_somebody AND (cond ~* '^\(?\s*auth\s*\.\s*uid\s*\(\s*\)\s+is\s+null\s*\)?$'
+        OR cond ~* '^not\s*\(\s*auth\s*\.\s*uid\s*\(\s*\)\s+is\s+not\s+null\s*\)$') THEN
+      RETURN jsonb_build_object('guarded', true, 'nullSlips', false);
+    END IF;
   END LOOP;
   RETURN jsonb_build_object('guarded', false, 'nullSlips', slips);
 END $$;
@@ -497,7 +511,7 @@ BEGIN
     body := regexp_replace(coalesce(r.def, ''), '--[^\n]*', ' ', 'g');
     conf := replace(replace(replace(coalesce(r.config, ''), '{', ''), '}', ''), '"', '');
     writes := body ~* writes_re;
-    door := __KN__.door_of(body, helpers);
+    door := __KN__.door_of(body, helpers, coalesce(r.args, ''));
     out_ := out_ || jsonb_build_array(jsonb_build_object(
       'name', r.name,
       'args', coalesce(r.args, ''),
@@ -3149,6 +3163,11 @@ DECLARE
   before_all jsonb;
   below jsonb;
   listed boolean;
+  team_columns text[];
+  move_sets text;
+  move_elsewhere text;
+  moved_ bigint;
+  move_result jsonb;
   their_team text;
   plain_ bigint;
   label_ text;
@@ -3218,6 +3237,51 @@ BEGIN
       CONTINUE;
     END IF;
 
+    -- Their own membership row - the one in their own team - moved into the
+    -- first person's team at the role at the top, before they join
+    -- (tamper.js; blind round 16, Meridian: memberships_update_self checked
+    -- only user_id = auth.uid()). One row only.
+    SELECT coalesce(array_agg(k ORDER BY k), ARRAY[]::text[]) INTO team_columns
+      FROM jsonb_object_keys(team) k WHERE team->>k IS NOT NULL;
+    IF member->>'top' IS NOT NULL AND array_length(team_columns, 1) IS NOT NULL THEN
+      finding_key := 'movein:' || (member->'table'->>'name');
+      SELECT string_agg(__KN__.always_quote(k) || ' = ' || quote_literal(team->>k), ', ' ORDER BY k),
+             string_agg(__KN__.always_quote(k) || ' IS DISTINCT FROM ' || quote_literal(team->>k), ' OR ' ORDER BY k)
+        INTO move_sets, move_elsewhere FROM unnest(team_columns) k;
+      move_sets := move_sets || ', ' || __KN__.always_quote(member->>'role') || ' = ' || quote_literal(member->>'top');
+      move_result := __KN__.try_write('authenticated', __KN__.user_b(),
+        'UPDATE ' || at || ' SET ' || move_sets || ' WHERE ctid = (SELECT ctid FROM ' || at || ' WHERE '
+          || __KN__.always_quote(member->>'person') || ' = ' || quote_literal(__KN__.user_b())
+          || ' AND (' || move_elsewhere || ') LIMIT 1)');
+      moved_ := __KN__.rows_moved(move_result);
+      IF moved_ IS NULL THEN
+        blocked := blocked || jsonb_build_array(jsonb_build_object(
+          'table', member->'table'->>'name', 'key', finding_key,
+          'why', 'moving their own ' || (member->'table'->>'name') || ' row into another ' || parent || ': '
+                 || (move_result->>'why')));
+      ELSE
+        completed := completed || to_jsonb(finding_key);
+        IF moved_ > 0 THEN
+          findings := findings || jsonb_build_array(jsonb_build_object(
+            'kind', 'role',
+            'table', member->'table'->>'name',
+            'who', 'anyone signed in',
+            'via', member->'table'->>'name',
+            'roleColumn', member->>'role',
+            'parent', parent,
+            'can', jsonb_build_array('movein'),
+            'changed', jsonb_build_object('movein', moved_),
+            'below', '[]'::jsonb,
+            'columns', coalesce((SELECT jsonb_agg(c->>'name') FROM jsonb_array_elements(member->'table'->'columns') c), '[]'::jsonb),
+            'rlsEnabled', coalesce((member->'table'->>'rlsEnabled')::boolean, false),
+            'promote', true,
+            'movein', true,
+            'toRole', member->>'top',
+            'moved', to_jsonb(team_columns)));
+        END IF;
+      END IF;
+    END IF;
+
     FOR tab IN SELECT * FROM jsonb_array_elements(tables) LOOP
       CONTINUE WHEN NOT EXISTS (SELECT 1 FROM jsonb_array_elements(coalesce(seeded, '[]'::jsonb)) s
                                  WHERE s->>'table' = tab->>'name');

package/finding.js

@@ -383,6 +383,10 @@ function headlineFor(finding) {
     return capital(aRole(finding.who)) + ' in ' + aOne(finding.parent) + ' can take another member\'s place in your ' +
       finding.table + ' table - and with it their role.';
   }
+  if (finding.kind === 'role' && finding.movein) {
+    return 'Anyone signed in can make themselves ' + aRole(finding.toRole) + ' of any ' + oneOf(finding.parent) +
+      ' by moving their own row in your ' + finding.table + ' table into it.';
+  }
   if (finding.kind === 'role' && finding.promote) {
     return capital(aRole(finding.who)) + ' in ' + aOne(finding.parent) + ' can make themselves ' + aRole(finding.toRole) +
       ' by changing their own row in your ' + finding.table + ' table.';
@@ -508,6 +512,19 @@ function bodyFor(finding, contents) {
     );
   }
 
+  if (finding.kind === 'role' && finding.movein) {
+    // Never the design: nobody was invited, and the team they moved into is
+    // somebody else's.
+    const place = oneOf(finding.parent);
+    return (
+      'Signed in as one of my fake people - not a member of the other one\'s ' + place + ', never invited - I ' +
+      'changed their own row in ' + finding.via + ': ' + listOf((finding.moved || []).map((c) => finding.via + '.' + c)) +
+      ' to the other ' + place + ', and ' + finding.via + '.' + finding.roleColumn + ' to "' + finding.toRole +
+      '" - on a copy of your app. It went through, and was undone straight away. Anybody who can sign up and has a ' +
+      place + ' of their own can do this to every ' + place + ' whose id they learn, and from then on has every right ' +
+      aRole(finding.toRole) + ' has there.'
+    );
+  }
   if (finding.kind === 'role' && finding.promote) {
     // Never the design: a member who can raise their own role has every
     // right the top role has, in every table that trusts the role.
@@ -955,6 +972,25 @@ function fixPromptFor(finding) {
       '',
       'Then check every function that updates "' + finding.via + '" for the same thing.',
     ]
+    : finding.kind === 'role' && finding.movein
+    ? [
+      'My app has a security problem - anyone signed in can make themselves ' + aRole(finding.toRole) + ' of any ' +
+        oneOf(finding.parent) + '.',
+      '',
+      'In my database, a signed-in user can update their own row in "' + finding.via + '" and change ' +
+        listOf((finding.moved || []).map((c) => '"' + c + '"')) + ' to another ' + oneOf(finding.parent) +
+        ' - one they were never invited to - and "' + finding.roleColumn + '" to "' + finding.toRole + '". The rule only ' +
+        'checks that the row is theirs, not what they change in it. This was proved on a copy of the database.',
+      '',
+      'Fix the rules on "' + finding.via + '" that cover UPDATE or ALL: nobody may change ' +
+        listOf((finding.moved || []).map((c) => '"' + c + '"')) + ' on an existing row, and a member must never be ' +
+        'able to change "' + finding.roleColumn + '" on their own row. Joining happens only by an invitation that ' +
+        'somebody who manages that ' + oneOf(finding.parent) + ' made. Let only the roles that manage the team change ' +
+        'membership rows, checked in WITH CHECK as well as USING - for example with a helper that reads "' + finding.via +
+        '" for auth.uid() and the row\'s own ' + listOf((finding.moved || []).map((c) => '"' + c + '"')) + '.',
+      '',
+      'Then check every function that updates "' + finding.via + '" for the same thing.',
+    ]
     : finding.kind === 'role' && finding.promote
     ? [
       'My app has a security problem - a member can make themselves ' + aRole(finding.toRole) + '.',
@@ -1371,6 +1407,8 @@ function describe(finding) {
     takeover: finding.takeover,
     personColumn: finding.personColumn,
     promote: finding.promote,
+    movein: finding.movein,
+    moved: finding.moved,
     toRole: finding.toRole,
     nullSlips: finding.nullSlips,
     noRule: finding.noRule,
@@ -1400,6 +1438,9 @@ function describe(finding) {
       : finding.kind === 'role' && finding.takeover
       ? 'As ' + aRole(finding.who) + ' who had just joined, I put my own id on the other person\'s row of "' +
         finding.via + '", which I could not touch before joining. It was undone.'
+      : finding.kind === 'role' && finding.movein
+      ? 'Signed in, and not a member, I moved my own row of "' + finding.via + '" into the other ' + oneOf(finding.parent) +
+        ' with "' + finding.roleColumn + '" set to "' + finding.toRole + '". It was undone.'
       : finding.kind === 'role' && finding.promote
       ? 'As ' + aRole(finding.who) + ' who had just joined, I set "' + finding.roleColumn + '" on my own row of "' +
         finding.via + '" to "' + finding.toRole + '". It was undone.'

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "kryptheon-night",
-  "version": "0.1.38",
+  "version": "0.1.39",
   "description": "Attacks a copy of your Supabase database and tells you in plain English what got in.",
   "license": "SEE LICENSE IN LICENSE",
   "type": "commonjs",

package/schema.js

@@ -242,8 +242,29 @@ function guardedAtTheDoor(body, helpers) {
  *
  * `helpers` are names (yes/no helpers about the caller) or { name, nullable }
  * (a role helper, which answers NULL for a stranger).
+ *
+ * "Is anybody signed in at all" - IF auth.uid() IS NULL THEN RAISE - counts
+ * only when the function takes nothing that could point at somebody else's
+ * row (`args`, as pg_get_function_identity_arguments says them). Found on a
+ * blind test (Meridian): bootstrap_organization(p_name text) opened with it,
+ * made a new organization owned by the caller, and was reported as "anyone
+ * on the internet can call it". A visitor with no account is turned away, and
+ * a signed-in one can only make their own. Given an organization's id, the
+ * same line would let any stranger who signed up act on that organization,
+ * so there it is still no guard.
  */
-function doorOf(body, helpers) {
+function namesSomebody(args) {
+  if (args === undefined || args === null) return true;
+  return String(args).split(',').map((a) => a.trim()).filter(Boolean).some((a) => {
+    const words = a.replace(/^(in|inout|variadic)\s+/i, '').split(/\s+/);
+    const name = words.length > 1 ? words[0].replace(/"/g, '') : '';
+    const type = words.slice(words.length > 1 ? 1 : 0).join(' ');
+    return /\b(uuid|oid|int[248]?|integer|bigint|smallint|numeric|serial|bigserial)\b/i.test(type) ||
+      /(^|_)(ids?|uids?|orgs?|organizations?|tenants?|teams?|workspaces?|accounts?|users?|owners?|members?|projects?|customers?|compan(y|ies))$/i.test(name);
+  });
+}
+
+function doorOf(body, helpers, args) {
   const text = String(body || '');
   const writes = /\b(insert\s+into|update\s+(only\s+)?["\w]+|delete\s+from|truncate|merge\s+into)\b/i.exec(text);
   const returns = /\breturn\b/i.exec(text);
@@ -267,6 +288,9 @@ function doorOf(body, helpers) {
     if (refusesOnNo && /\bauth\s*\.\s*(uid|jwt)\s*\(/i.test(cond) && /admin|owner|member|role/i.test(cond)) {
       return { guarded: true, nullSlips: false };
     }
+    const signedIn = /^\(?\s*auth\s*\.\s*uid\s*\(\s*\)\s+is\s+null\s*\)?$/i.test(cond) ||
+      /^not\s*\(\s*auth\s*\.\s*uid\s*\(\s*\)\s+is\s+not\s+null\s*\)$/i.test(cond);
+    if (signedIn && !namesSomebody(args)) return { guarded: true, nullSlips: false };
     if (list.some((h) => h.nullable && asks(cond, h.name))) {
       const refuses = refusesOnNo || /\bnot\s+in\s*\(/i.test(cond) || /<>|!=/.test(cond);
       const nullSafe = /\bcoalesce\s*\(/i.test(cond) || /\bis\s+null\b/i.test(cond) || /\bis\s+not\s+true\s*$/i.test(cond);
@@ -351,7 +375,7 @@ async function readAnonDefinerFunctions(client, schema, role) {
     // org_role was reported beside the functions it guards.
     const aboutCaller = (row.returns_bool === true || row.returns_enum === true) && !writes &&
       /\bauth\s*\.\s*(uid|jwt)\s*\(/i.test(body);
-    const door = doorOf(body, helpers);
+    const door = doorOf(body, helpers, row.args || '');
     return {
       name: row.name,
       args: row.args || '',

package/tamper.js

@@ -460,6 +460,52 @@ async function teammate(client, schema, tables, seeded, rules) {
       continue;
     }
 
+    // Their own membership row - the one in their own team - moved into the
+    // first person's team, at the role at the top. Found on blind round 16
+    // (Meridian): memberships_update_self checked only user_id = auth.uid(),
+    // so anybody who had signed up and made a team of their own could move
+    // that row into any other organization as its owner, without ever being
+    // invited. Tried before they join, so nothing an invitation gave them
+    // counts. One row only: two of theirs moved into one team would be
+    // refused as duplicates and say nothing.
+    const teamColumns = Object.keys(team).filter((name) => team[name] !== null && team[name] !== undefined).sort();
+    if (member.top && teamColumns.length) {
+      const key = 'movein:' + member.table.name;
+      const literal = (value) => "'" + String(value).split("'").join("''") + "'";
+      const sets = teamColumns.map((name) => quote(name) + ' = ' + literal(team[name]))
+        .concat([quote(member.role) + ' = ' + literal(member.top)]);
+      const elsewhere = teamColumns.map((name) => quote(name) + ' IS DISTINCT FROM ' + literal(team[name])).join(' OR ');
+      const statement = 'UPDATE ' + at + ' SET ' + sets.join(', ') + ' WHERE ctid = (SELECT ctid FROM ' + at + ' WHERE ' +
+        quote(member.person) + " = '" + attack.USER_B + "' AND (" + elsewhere + ') LIMIT 1)';
+      const result = await tryWrite(client, 'authenticated', attack.USER_B, statement, []);
+      const moved = counted(result);
+      if (moved === null) {
+        blocked.push({ table: member.table.name, key: key, why: 'moving their own ' + member.table.name + ' row into another ' +
+          parent + ': ' + result.why });
+      } else {
+        completed.push(key);
+        if (moved > 0) {
+          findings.push({
+            kind: 'role',
+            table: member.table.name,
+            who: 'anyone signed in',
+            via: member.table.name,
+            roleColumn: member.role,
+            parent: parent,
+            can: ['movein'],
+            changed: { movein: moved },
+            below: [],
+            columns: (member.table.columns || []).map((c) => c.name),
+            rlsEnabled: member.table.rlsEnabled,
+            promote: true,
+            movein: true,
+            toRole: member.top,
+            moved: teamColumns,
+          });
+        }
+      }
+    }
+
     for (const table of tables) {
       if (!shapeFor.has(table.name) || done.has(table.name)) continue;
       done.add(table.name);