kryptheon-night 0.1.8 → 0.1.10

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "kryptheon-night",
-  "version": "0.1.8",
+  "version": "0.1.10",
   "description": "Attacks a copy of your Supabase database and tells you in plain English what got in.",
   "license": "MIT",
   "type": "commonjs",
@@ -31,7 +31,7 @@
     "node": ">=18.0.0"
   },
   "scripts": {
-    "check": "node package.check.js && node store.check.js && node trouble.check.js && node intro.check.js && node finding.check.js && node outside.check.js && node recheck.check.js && node untouched.check.js && node blocked.check.js && node orphans.check.js && node guests.check.js && node usable.check.js && node twin.check.js && node engines.check.js && node external.check.js && node schema.check.js && node collision.check.js && node tamper.check.js && node orphan.check.js && node shapes.check.js && node verdicts.check.js && node shop.check.js && node loop.check.js",
+    "check": "node package.check.js && node store.check.js && node trouble.check.js && node intro.check.js && node finding.check.js && node outside.check.js && node recheck.check.js && node untouched.check.js && node blocked.check.js && node orphans.check.js && node guests.check.js && node usable.check.js && node twin.check.js && node engines.check.js && node external.check.js && node schema.check.js && node collision.check.js && node tamper.check.js && node orphan.check.js && node shapes.check.js && node verdicts.check.js && node shop.check.js && node privileged.check.js && node cli.check.js && node loop.check.js",
     "check:dry": "node package.check.js && node store.check.js && node trouble.check.js && node intro.check.js && node finding.check.js && node recheck.check.js && node outside.check.js",
     "check:package": "node package.check.js",
     "check:store": "node store.check.js",
@@ -52,6 +52,8 @@
     "check:shapes": "node shapes.check.js",
     "check:verdicts": "node verdicts.check.js",
     "check:shop": "node shop.check.js",
+    "check:privileged": "node privileged.check.js",
+    "check:cli": "node cli.check.js",
     "check:writes": "node tamper.check.js",
     "check:orphans": "node orphans.check.js",
     "probe:write": "node probe-write.js",

package/recheck.js

@@ -42,9 +42,20 @@ function keyOf(item) {
  * untestable table would land in `fixed`, and a green badge would be handed to
  * an app nobody checked.
  */
+/**
+ * A report shows one finding per table, but each one keeps the proofs it was
+ * made of. Those are what get compared: closing a table to strangers' writes
+ * while it stays readable is one proof fixed and one still open, not "the
+ * table's finding" either fixed or not. Reports saved before findings were
+ * grouped have no members, and are read as they are.
+ */
+function proofsOf(list) {
+  return (list || []).reduce((all, item) => all.concat(item.members && item.members.length ? item.members : [item]), []);
+}
+
 function compare(before, after) {
-  const was = (before && before.findings) || [];
-  const now = (after && after.findings) || [];
+  const was = proofsOf(before && before.findings);
+  const now = proofsOf(after && after.findings);
 
   // The second run failed outright. Nothing can be claimed about anything.
   if (after && after.stopped) {
@@ -116,6 +127,9 @@ function compare(before, after) {
     stillOpen: stillOpen,
     unverifiable: unverifiable,
     newlyBroken: newlyBroken,
+    // Carried so the re-check can say why there is no green light when the
+    // only thing standing in the way is what could not be tested.
+    untested: skipped,
     // Green is the strictest thing this program says, so it is the hardest to
     // earn: everything that was wrong is now provably right, nothing new broke,
     // and nothing at all was left untested.
@@ -146,6 +160,21 @@ function badgeLines(result, attacksRun) {
   ];
 }
 
+/**
+ * Which proof a line is about. One table can have several - strangers reading
+ * it, strangers writing to it - and "waitlist, waitlist" under "fixed" would
+ * not say which one was closed.
+ */
+function whatOf(item) {
+  if (item.kind === 'exposed') return 'read by anyone';
+  if (item.kind === 'crossed') return "customers reading each other's rows";
+  if (item.kind === 'writable') return item.who === 'anyone' ? 'written by anyone' : 'written by any signed-in customer';
+  if (item.kind === 'duplicated') return 'the same ' + (item.column || 'value') + ' twice';
+  if (item.kind === 'orphaned') return 'rows left pointing at nothing';
+  if (item.kind === 'privileged') return 'a function anyone can call';
+  return item.kind;
+}
+
 /** What the re-check says, in the order it matters. */
 function describe(result) {
   const lines = [''];
@@ -162,7 +191,7 @@ function describe(result) {
     lines.push('  ' + result.fixed.length + (result.fixed.length === 1 ? ' problem is' : ' problems are') + ' fixed:');
     lines.push('');
     for (const item of result.fixed) {
-      lines.push('    ' + item.table + ' - I ran the same attack again and it was refused.');
+      lines.push('    ' + item.table + ' (' + whatOf(item) + ') - I ran the same attack again and it was refused.');
     }
     lines.push('');
   }
@@ -182,7 +211,7 @@ function describe(result) {
     lines.push('  ' + result.unverifiable.length + ' I could NOT confirm:');
     lines.push('');
     for (const item of result.unverifiable) {
-      lines.push('    ' + item.table + ' - ' + item.why);
+      lines.push('    ' + item.table + ' (' + whatOf(item) + ') - ' + item.why);
     }
     lines.push('');
     lines.push('  These are not fixed and not broken - they are unknown. The problem');
@@ -208,6 +237,18 @@ function describe(result) {
     lines.push('');
   }
 
+  // Found on a real app: "1 problem is fixed", nothing else, and a non-zero
+  // exit with no word about why. The reason was parts of the app that could
+  // not be tested - which has to be said, or the exit code reads as a bug.
+  const untested = result.untested || [];
+  if (untested.length) {
+    lines.push('  No green light yet: ' + untested.length + ' ' +
+      (untested.length === 1 ? 'part of your app was' : 'parts of your app were') +
+      ' not tested this time, so I cannot');
+    lines.push('  call it clear. They are listed at the end, with the reason for each.');
+    lines.push('');
+  }
+
   return lines;
 }
 

package/scan.js

@@ -344,13 +344,52 @@ async function scan(client, sourceSchema, options) {
       }
     }
 
+    // Where people actually sign in decides how bad a duplicate email is. On
+    // Supabase that is auth.users, which keeps emails unique; a public table's
+    // email column is then a copy. Only read, never written.
+    const loginElsewhere = (await client.query("select to_regclass('auth.users') is not null as found")).rows[0].found;
+    const raced = collisions.findings.map((f) =>
+      f.expectation === 'identity' ? Object.assign({}, f, { loginElsewhere: loginElsewhere }) : f,
+    );
+
+    // Functions an anonymous visitor can call that run past the rules. Read
+    // from the shape, not attacked: nothing is executed, because whether such
+    // a function is meant to be public is a question only the owner answers.
+    //
+    // Every definer function read this run counts as examined, whether or not
+    // anon can call it. That is what lets the re-check call a revoked grant
+    // fixed: the function was looked at again and the reach was gone. The first
+    // version recorded only the flagged ones, so a revoke made the function
+    // vanish from both lists and the fix came back as "could not confirm".
+    for (const fn of plan.anonFunctions || []) attempted.push('privileged:' + fn.name);
+    const privileged = (plan.anonFunctions || []).filter((fn) => fn.callable).map((fn) => ({
+      kind: 'privileged',
+      fn: fn.name,
+      table: fn.name,
+      args: fn.args,
+      writes: fn.writes,
+      hasFixedSearchPath: fn.hasFixedSearchPath,
+      columns: [],
+    }));
+
+    // Whether each table is tied to Supabase's sign-in decides what its fix
+    // can be. Read from the original schema: the copy points auth.users keys
+    // at a stand-in, and would call every table untied.
+    const ties = finding.authTiesOf(plan);
+    // And whether a row says whose it is: with no such column, no rule can
+    // tie it to the person asking. Read from the copy, the way seeding did.
+    const owned = new Map(theirs.map((table) => [table.name, Boolean(attack.ownerColumn(table))]));
+    const tagged = (f) => Object.assign({}, f,
+      ties.has(f.table) ? { authTied: ties.get(f.table) } : {},
+      owned.has(f.table) ? { owned: owned.get(f.table) } : {});
+
     return {
       stopped: null,
       attacksRun: attempted.length,
       notChecked: notChecked,
       attempted: attempted,
       findings: finding.describeAll(
-        impersonation.findings.concat(writes.findings, stranded.findings, collisions.findings),
+        impersonation.findings.concat(writes.findings, stranded.findings, raced, privileged).map(tagged),
       ),
     };
   } finally {
@@ -363,6 +402,17 @@ async function scan(client, sourceSchema, options) {
   }
 }
 
+/**
+ * The exit code of a first run: 2 could not run, 1 something got through, 0
+ * every attack lost. Only confirmed findings count as "got through" - a
+ * function flagged for verification was never executed, and a script reading
+ * 1 would act on a break nobody demonstrated.
+ */
+function exitCodeFor(result) {
+  if (result.stopped) return 2;
+  return (result.findings || []).some((f) => f.status !== 'verification required') ? 1 : 0;
+}
+
 /** The last run, or null if there has not been one worth keeping. */
 function loadLastRun(file) {
   try {
@@ -477,18 +527,29 @@ function report(result) {
 
   sayWhatWasMissed();
 
-  const count = result.findings.length;
+  // Confirmed breaks and things that only need a look are not the same claim,
+  // so they are counted apart. Saying "3 problems" when one of them was never
+  // executed is the kind of overstatement that costs the next report its trust.
+  const confirmed = result.findings.filter((f) => f.status !== 'verification required');
+  const toVerify = result.findings.filter((f) => f.status === 'verification required');
   line('');
-  line('  ' + count + (count === 1 ? ' problem' : ' problems') + ' found.');
+  if (confirmed.length) {
+    line('  ' + confirmed.length + (confirmed.length === 1 ? ' problem' : ' problems') + ' found.');
+  }
+  if (toVerify.length) {
+    line('  ' + toVerify.length + ' thing' + (toVerify.length === 1 ? '' : 's') +
+      ' to check - I did not attack ' + (toVerify.length === 1 ? 'it' : 'them') + ', only spotted the risk.');
+  }
 
   for (const item of result.findings) {
     line('');
     line('  ' + '-'.repeat(68));
-    line('  ' + item.severity + '   ' + item.table);
+    line('  ' + item.severity + '   ' + item.table +
+      (item.status === 'verification required' ? '   (verification required)' : ''));
     line('');
     line('  ' + item.headline);
     line('');
-    for (const paragraph of [item.body, item.cause]) {
+    for (const paragraph of [item.body, item.cause].filter(Boolean)) {
       wrap(paragraph, 70).forEach((l) => line('  ' + l));
       line('');
     }
@@ -587,7 +648,7 @@ async function main() {
       // Three answers, three codes: 0 clean, 1 problems found, 2 could not
       // run. A scan that stopped used to exit 0 with no findings, which is
       // what any script watching it would read as a pass.
-      process.exitCode = result.stopped ? 2 : result.findings.length ? 1 : 0;
+      process.exitCode = exitCodeFor(result);
       return;
     }
 
@@ -596,6 +657,7 @@ async function main() {
     recheck.badgeLines(verdict, result.attacksRun || 0).forEach(line);
     // The verdict says what changed; this says what to do about what did not.
     if (result.findings.length) report(result);
+    else notTestedLines(result).forEach(line);
     saveRun(file, result);
     process.exitCode = result.stopped ? 2 : verdict.allClear ? 0 : 1;
   } finally {
@@ -621,5 +683,6 @@ module.exports = {
   sweepOldCopies: sweepOldCopies,
   notTestedLines: notTestedLines,
   lastRunFile: lastRunFile,
+  exitCodeFor: exitCodeFor,
   ABANDONED_AFTER: ABANDONED_AFTER,
 };