kryptheon-night 0.1.39 → 0.1.41

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "kryptheon-night",
-  "version": "0.1.39",
+  "version": "0.1.41",
   "description": "Attacks a copy of your Supabase database and tells you in plain English what got in.",
   "license": "SEE LICENSE IN LICENSE",
   "type": "commonjs",
@@ -16,7 +16,7 @@
     "outside.js",
     "collision.js",
     "tamper.js",
-    "orphan.js",
+    "orphan.js", "races.js",
     "recheck.js",
     "intro.js",
     "trouble.js",
@@ -31,7 +31,7 @@
     "node": ">=18.0.0"
   },
   "scripts": {
-    "check": "node package.check.js && node store.check.js && node trouble.check.js && node intro.check.js && node finding.check.js && node outside.check.js && node recheck.check.js && node untouched.check.js && node blocked.check.js && node orphans.check.js && node guests.check.js && node usable.check.js && node twin.check.js && node engines.check.js && node external.check.js && node schema.check.js && node collision.check.js && node tamper.check.js && node orphan.check.js && node shapes.check.js && node verdicts.check.js && node shop.check.js && node privileged.check.js && node recursion.check.js && node guarded.check.js && node nightly.check.js && node words.check.js && node helpers.check.js && node deeploop.check.js && node teams.check.js && node roles.check.js && node buckets.check.js && node cli.check.js && node loop.check.js && node report.check.js && node installscript.check.js && node tenants.check.js && node takeover.check.js && node elevated.check.js && node checkfit.check.js && node declared.check.js && node identity.check.js",
+    "check": "node package.check.js && node store.check.js && node trouble.check.js && node intro.check.js && node finding.check.js && node outside.check.js && node recheck.check.js && node untouched.check.js && node blocked.check.js && node orphans.check.js && node guests.check.js && node usable.check.js && node twin.check.js && node engines.check.js && node external.check.js && node schema.check.js && node collision.check.js && node tamper.check.js && node orphan.check.js && node shapes.check.js && node verdicts.check.js && node shop.check.js && node privileged.check.js && node recursion.check.js && node guarded.check.js && node nightly.check.js && node words.check.js && node helpers.check.js && node deeploop.check.js && node teams.check.js && node roles.check.js && node buckets.check.js && node cli.check.js && node loop.check.js && node report.check.js && node installscript.check.js && node tenants.check.js && node takeover.check.js && node elevated.check.js && node checkfit.check.js && node declared.check.js && node races.check.js && node identity.check.js",
     "check:dry": "node package.check.js && node store.check.js && node trouble.check.js && node intro.check.js && node finding.check.js && node recheck.check.js && node outside.check.js",
     "check:package": "node package.check.js",
     "check:store": "node store.check.js",

package/races.js

@@ -0,0 +1,304 @@
+// Races, read from the app's own functions.
+//
+// collision.js explains why a lost update cannot be reported from the schema:
+// whether two requests at once both win depends on code the tool never sees.
+// On Supabase that code is very often in the database - an RPC such as
+// reserve_stock() or create_ticket() - and its text is in the catalogue. So
+// this reads it, and says what the text shows: a step that looks something up
+// and then writes on the strength of it, with nothing that makes a second
+// caller wait or fail. Nothing is run. Every finding is "to check".
+//
+// Three shapes, each missed by a blind test (rounds 11, 15 and 16):
+//
+//   number    SELECT max(n) + 1 INTO v FROM t, then INSERT INTO t with it - or
+//             hand it back for the app to insert - and no unique rule on n:
+//             two callers take the same number.
+//             (create_ticket, create_work_order, reserve_subscription_code)
+//   overdraw  SELECT a quantity INTO a variable, RAISE when it is too low,
+//             then UPDATE it: two callers both pass the check. (reserve_stock)
+//   double    look for a row (IF EXISTS, or SELECT ... INTO and an IF on it),
+//             then INSERT one, and no unique rule on what was looked up: two
+//             callers both find nothing and both insert.
+//             (assign_asset, record_receipt)
+//
+// A shape is safe, and only counted as examined, when:
+//   - a unique key or unique index covers the columns it depends on (the
+//     second caller then fails instead of slipping through);
+//   - the INSERT has ON CONFLICT;
+//   - for overdraw, the read is FOR UPDATE / FOR SHARE, the UPDATE tests the
+//     column again in its WHERE, or a CHECK holds it (see below);
+//   - a row lock comes earlier in the function, or it takes an advisory lock,
+//     LOCK TABLE or SERIALIZABLE anywhere.
+//
+// Mirrored in engine.sql race_shapes.
+
+const LOCKS = /\b(pg_advisory_xact_lock|pg_advisory_lock|pg_try_advisory_xact_lock|pg_try_advisory_lock|lock\s+table|isolation\s+level\s+serializable)\b/;
+const ROW_LOCK = /\bfor\s+(update|no\s+key\s+update|share|key\s+share)\b/;
+// A name as written, quoted or not: "public"."tickets" as well as public.tickets.
+const NAME = '"?[a-z_][a-z0-9_$."]*';
+
+/** The body as statements: comments and string contents gone, lower case,
+ *  one space, split on ";", and a leading BEGIN / END IF / ELSE dropped so a
+ *  statement starts with what it does. */
+function statementsOf(def) {
+  const text = String(def || '')
+    .replace(/\/\*[\s\S]*?\*\//g, ' ')
+    .replace(/--[^\n]*/g, ' ')
+    .replace(/'(?:[^']|'')*'/g, "''")
+    .toLowerCase()
+    .replace(/\s+/g, ' ')
+    // Only the body: "create function ... as $function$" and the closing
+    // $function$ off. Left on, a function with no DECLARE had its first IF
+    // glued to the header and never read as an IF.
+    .replace(/^[\s\S]*?\bas\s+\$[a-z0-9_]*\$\s*/, '')
+    .replace(/\s*\$[a-z0-9_]*\$\s*$/, '');
+  return text.split(';')
+    .map((x) => x.trim().replace(/^(?:(?:begin|else|then|loop|end\s+if|end\s+loop)\s+)+/, ''))
+    .filter(Boolean);
+}
+
+/** A name as written - public.t, "t", x.col - reduced to its last part. */
+function bare(name) {
+  const parts = String(name || '').replace(/"/g, '').split('.');
+  return parts[parts.length - 1];
+}
+
+/** Identifiers in a piece of SQL, each reduced to its last part. */
+function identifiers(text) {
+  return (String(text || '').match(/[a-z_][a-z0-9_$."]*/g) || []).map(bare);
+}
+
+function mentions(text, names) {
+  return names.some((v) => new RegExp('(^|[^a-z0-9_$])' + v.replace(/\$/g, '\\$') + '($|[^a-z0-9_$])').test(text));
+}
+
+/** The text up to the bracket that closes the one already open. */
+function untilClose(text) {
+  let depth = 0;
+  for (let i = 0; i < text.length; i++) {
+    if (text[i] === '(') depth++;
+    else if (text[i] === ')') { if (depth === 0) return text.slice(0, i); depth--; }
+  }
+  return text;
+}
+
+/** Column sets a second caller cannot repeat: primary keys, uniques, unique indexes. */
+function uniqueSetsOf(plan, table) {
+  const sets = [];
+  const t = (plan.tables || []).find((x) => x.name === table);
+  for (const con of (t && t.constraints) || []) {
+    if (con.kind !== 'u' && con.kind !== 'p') continue;
+    const inner = /\(([^)]*)\)/.exec(con.definition || '');
+    if (inner) sets.push(identifiers(inner[1].toLowerCase()));
+  }
+  for (const idx of plan.indexes || []) {
+    if (idx.table_name !== table) continue;
+    // CREATE UNIQUE INDEX i ON public.t USING btree (a, lower(b)) WHERE (...)
+    const at = /\busing\s+\w+\s*\(/i.exec(idx.definition || '');
+    if (at) sets.push(identifiers(untilClose(String(idx.definition).slice(at.index + at[0].length).toLowerCase())));
+  }
+  return sets.filter((x) => x.length);
+}
+
+function tableOf(plan, table) {
+  return (plan.tables || []).find((x) => x.name === table) || { columns: [], constraints: [] };
+}
+
+/** FROM t [alias] WHERE ..., for the first table named after a point. The
+ *  alias is never a keyword: reading "FROM t WHERE" as t aliased "where" lost
+ *  the condition (assign_asset, record_receipt on round 16). */
+function fromWhere(stmt) {
+  const m = new RegExp('\\bfrom\\s+(' + NAME + ')(?:\\s+(?:as\\s+)?(?!(?:where|for|limit|order|group|join|left|right|inner|cross|into|on|returning|union|then)\\b)[a-z_][a-z0-9_]*)?(?:\\s+where\\s+(.*))?').exec(stmt);
+  if (!m) return null;
+  const where = untilClose((m[2] || '').replace(/\b(for\s+(update|no key update|share|key share)|limit|order\s+by|group\s+by|returning)\b.*$/, ''));
+  return { table: bare(m[1]), where: where };
+}
+
+/** The columns a WHERE pins with "col = something". */
+function pinnedBy(where) {
+  const pins = [];
+  const re = new RegExp('(' + NAME + ')\\s*=(?!=)', 'g');
+  for (let m; (m = re.exec(where));) pins.push(bare(m[1]));
+  return Array.from(new Set(pins)).sort();
+}
+
+function insertInto(stmts, from, table) {
+  for (let j = from; j < stmts.length; j++) {
+    const m = new RegExp('\\binsert\\s+into\\s+(' + NAME + ')').exec(stmts[j]);
+    // Only an ON CONFLICT that names its target: Postgres then needs a unique
+    // index to plan it, so the second caller is caught. A bare ON CONFLICT DO
+    // NOTHING on a table with no unique rule never conflicts at all.
+    if (m && bare(m[1]) === table) return { at: j, onConflict: /\bon\s+conflict\s*(\(|on\s+constraint\b)/.test(stmts[j]) };
+  }
+  return null;
+}
+
+/** SET a = <expr>, b = <expr>: each target with what it is set to. */
+function setsOf(list) {
+  const out = [];
+  let depth = 0, cut = 0;
+  for (let k = 0; k <= list.length; k++) {
+    const ch = list[k];
+    if (ch === '(') depth++;
+    else if (ch === ')') depth--;
+    else if ((ch === ',' && depth === 0) || k === list.length) {
+      const m = new RegExp('^\\s*(' + NAME + ')\\s*=(.*)$').exec(list.slice(cut, k));
+      if (m) out.push({ column: bare(m[1]), expr: m[2] });
+      cut = k + 1;
+    }
+  }
+  return out;
+}
+
+/** SELECT <list> INTO <vars> FROM ...: split at the first " into " and the
+ *  first " from " after it - by position, not a lazy pattern, so engine.sql
+ *  (whose regular expressions are not lazy the same way) reads it alike. */
+function selectInto(stmt) {
+  if (!stmt.startsWith('select ')) return null;
+  const rest = stmt.slice(7);
+  const a = rest.indexOf(' into ');
+  if (a < 0) return null;
+  let after = rest.slice(a + 6);
+  if (after.startsWith('strict ')) after = after.slice(7);
+  const b = after.indexOf(' from ');
+  if (b < 0) return null;
+  return { list: rest.slice(0, a), vars: after.slice(0, b) };
+}
+
+/** UPDATE t SET <list> [WHERE <cond>], split at the first " where ". */
+function updateOf(stmt) {
+  const m = new RegExp('^update\\s+(?:only\\s+)?(' + NAME + ')\\s+(?:as\\s+[a-z_][a-z0-9_]*\\s+)?set\\s+(.*)$').exec(stmt);
+  if (!m) return null;
+  const w = m[2].indexOf(' where ');
+  return { table: bare(m[1]), list: w < 0 ? m[2] : m[2].slice(0, w), where: w < 0 ? '' : m[2].slice(w + 7) };
+}
+
+/** Every race shape one function's text shows, each marked safe or not. */
+function shapesInFunction(fn, plan) {
+  const out = [];
+  const stmts = statementsOf(fn.def);
+  const locked = LOCKS.test(stmts.join('; '));
+  const tables = new Set((plan.tables || []).map((t) => t.name));
+  const lockedBy = (i) => stmts.slice(0, i + 1).some((x) => ROW_LOCK.test(x));
+  const add = (how, table, column, safe) => out.push({ how: how, table: table, column: column, safe: locked || safe });
+
+  stmts.forEach((s, i) => {
+    // number
+    const max = /\bmax\s*\(/.exec(s);
+    if (max && /\)\s*\+\s*1\b/.test(s.slice(max.index)) && /\binto\b/.test(s)) {
+      const src = fromWhere(s.slice(max.index));
+      if (!src || !tables.has(src.table)) return;
+      const cols = new Set(tableOf(plan, src.table).columns.map((c) => String(c.name).toLowerCase()));
+      const column = identifiers(untilClose(s.slice(max.index + max[0].length))).find((c) => cols.has(c));
+      if (!column) return;
+      const ins = insertInto(stmts, i + 1, src.table);
+      // Or handed back for the app to insert: reserve_subscription_code()
+      // returned "PREFIX-00042" built from it (round 11, HL-04), through any
+      // x := ... n ... on the way.
+      const into = /\binto\s+([a-z_][a-z0-9_$]*)\s+from\b/.exec(s);
+      const carried = into ? [into[1]] : [];
+      let handedBack = false;
+      for (const x of stmts.slice(i + 1)) {
+        const set = /^([a-z_][a-z0-9_$]*)\s*:=/.exec(x);
+        if (set && mentions(x, carried)) carried.push(set[1]);
+        else if (/^return\b/.test(x) && mentions(x, carried)) { handedBack = true; break; }
+      }
+      if (!ins && !handedBack) return;
+      add('number', src.table, column,
+        lockedBy(i) || (ins && ins.onConflict) || uniqueSetsOf(plan, src.table).some((set) => set.includes(column)));
+      return;
+    }
+
+    const read = selectInto(s);
+
+    // overdraw
+    if (read) {
+      const src = fromWhere(s);
+      if (src && tables.has(src.table)) {
+        const selected = identifiers(read.list);
+        const vars = identifiers(read.vars);
+        const tab = tableOf(plan, src.table);
+        const cols = new Set(tab.columns.map((c) => String(c.name).toLowerCase()));
+        const checks = tab.constraints.filter((c) => c.kind === 'c').map((c) => String(c.definition || '').toLowerCase());
+        for (let j = i + 1; j < stmts.length; j++) {
+          const up = updateOf(stmts[j]);
+          if (!up || up.table !== src.table) continue;
+          const refused = stmts.slice(i + 1, j).some((x) => /\braise\b/.test(x) && mentions(x, vars));
+          if (!refused) continue;
+          for (const { column, expr } of setsOf(up.list)) {
+            if (!selected.includes(column)) continue;
+            // A CHECK stops the second caller only when the UPDATE works on
+            // the column itself (a = a - x) and the CHECK is a floor under the
+            // subtraction, or ties the column to another one (reserved <=
+            // on_hand). "a = v - x", set from what was read, is the lost
+            // update itself and no CHECK sees it; reserve_stock's
+            // CHECK (reserved_quantity >= 0) does nothing for an addition.
+            const self = mentions(expr, [column]);
+            const held = self && checks.some((c) => mentions(c, [column]) &&
+              (/-/.test(expr) || identifiers(c).some((x) => x !== column && cols.has(x))));
+            add('overdraw', src.table, column, lockedBy(i) || mentions(up.where, [column]) || held);
+          }
+        }
+      }
+    }
+
+    // double
+    const exists = /\bexists\s*\(\s*select\b/.exec(s);
+    const lookup = exists ? fromWhere(s.slice(exists.index))
+      : read && !/\b(count|sum|min|avg|max)\s*\(/.test(read.list) ? fromWhere(s) : null;
+    if (!lookup || !tables.has(lookup.table)) return;
+    const pins = pinnedBy(lookup.where);
+    const ins = insertInto(stmts, i + 1, lookup.table);
+    if (!pins.length || !ins) return;
+    const vars = read && !exists ? identifiers(read.vars) : [];
+    const branches = exists ? /^(if|elsif)\b/.test(s)
+      : stmts.slice(i + 1, ins.at).some((x) => /^(if|elsif)\b/.test(x) && (/\bfound\b/.test(x) || mentions(x, vars)));
+    if (!branches) return;
+    add('double', lookup.table, pins.join(','),
+      lockedBy(i) || ins.onConflict || uniqueSetsOf(plan, lookup.table).some((set) => set.every((c) => pins.includes(c))));
+  });
+  return out;
+}
+
+/** Every shape in the app's functions: { fn, args, how, table, column, safe }. */
+function raceShapesOf(plan) {
+  const out = [];
+  for (const fn of (plan && plan.functions) || []) {
+    if (fn.from_extension) continue;
+    if (fn.language && !/^(plpgsql|sql)$/.test(String(fn.language))) continue;
+    for (const shape of shapesInFunction(fn, plan)) out.push(Object.assign({ fn: fn.name, args: fn.args || '' }, shape));
+  }
+  return out;
+}
+
+const order = (a, b) => {
+  const x = a.fn + '\u0000' + a.how + '\u0000' + a.table + '\u0000' + a.column;
+  const y = b.fn + '\u0000' + b.how + '\u0000' + b.table + '\u0000' + b.column;
+  return x < y ? -1 : x > y ? 1 : 0;
+};
+
+/** The races to report: shapes nothing makes safe, one per function, how,
+ *  table and column. */
+function racesOf(plan) {
+  const seen = new Map();
+  for (const shape of raceShapesOf(plan)) {
+    const key = shape.fn + ':' + shape.how + ':' + shape.table + ':' + shape.column;
+    seen.set(key, seen.has(key) ? (seen.get(key) && shape.safe) : shape.safe);
+  }
+  const out = [];
+  for (const shape of raceShapesOf(plan)) {
+    const key = shape.fn + ':' + shape.how + ':' + shape.table + ':' + shape.column;
+    if (seen.get(key) !== false) continue;
+    seen.set(key, true);
+    out.push({ kind: 'race', how: shape.how, fn: shape.fn, args: shape.args, table: shape.table, column: shape.column, columns: [] });
+  }
+  return out.sort(order);
+}
+
+/** What counts as examined, for the re-check: every shape read, safe or not,
+ *  keyed the way a finding is (recheck.js keyOf). */
+function raceKeysOf(plan) {
+  return Array.from(new Set(raceShapesOf(plan).map((x) => 'race:' + x.table + ':' + x.column))).sort();
+}
+
+module.exports = { racesOf: racesOf, raceKeysOf: raceKeysOf, raceShapesOf: raceShapesOf, statementsOf: statementsOf };

package/recheck.js

@@ -233,6 +233,7 @@ function whatOf(item) {
   if (item.kind === 'conflict') return 'an upsert Postgres refuses';
   if (item.kind === 'nullcheck') return 'a ' + (item.column || 'value') + ' that can be left empty';
   if (item.kind === 'noinsert') return 'no row can be added';
+  if (item.kind === 'race') return 'two calls at once in ' + (item.fn || 'a function');
   return item.kind;
 }
 
@@ -318,6 +319,9 @@ function describe(result) {
           : 'I asked Postgres to plan it again, and it accepted it.')
         : item.kind === 'noinsert'
         ? (elsewhere ? 'I looked here, and a rule for adding rows checks something.' : 'I looked again, and a rule for adding rows now checks something.')
+        : item.kind === 'race'
+        ? (elsewhere ? 'I read it here, and something stops a second call - a unique rule, a lock, or the check repeated in the same statement.'
+          : 'I read it again, and something now stops a second call - a unique rule, a lock, or the check repeated in the same statement.')
         : item.kind === 'nullcheck'
         ? (elsewhere ? 'I looked here, and it cannot be left empty.' : 'I looked again, and it can no longer be left empty.')
         : item.kind === 'recursive'