kryptheon-night 0.1.8 → 0.1.9

package/bin/kryptheon-night.js

@@ -561,12 +561,15 @@ async function main() {
     if (!before) {
       scanner.report(result);
       scanner.saveRun(file, result);
-      process.exitCode = result.stopped ? 2 : result.findings.length ? 1 : 0;
+      process.exitCode = scanner.exitCodeFor(result);
     } else {
       const verdict = recheck.compare(before, result);
       recheck.describe(verdict).forEach(line);
       recheck.badgeLines(verdict, result.attacksRun || 0).forEach(line);
+      // The report ends with what was not tested; with nothing left to report
+      // that list still has to be printed, or the re-check goes quiet about it.
       if (result.findings.length) scanner.report(result);
+      else scanner.notTestedLines(result).forEach(line);
       scanner.saveRun(file, result);
       process.exitCode = result.stopped ? 2 : verdict.allClear ? 0 : 1;
     }

package/finding.js

@@ -72,6 +72,14 @@ function listOf(items) {
  * should be fixed - there is no such thing as a low finding here.
  */
 function severityOf(finding, contents) {
+  if (finding.kind === 'privileged') {
+    // Not proven, so never CRITICAL: this is a reach that exists, not a break
+    // that was demonstrated. A function anon can call that also writes is worth
+    // more attention than one that only reads, but both stay HIGH and both
+    // carry "verification required" - the person has to say whether the anon
+    // call was intended.
+    return 'HIGH';
+  }
   if (finding.kind === 'orphaned') {
     // Nothing is exposed and nothing is destroyed, so this is not the same
     // order of thing as a table anyone can empty. It stays serious because
@@ -90,7 +98,13 @@ function severityOf(finding, contents) {
     // the table. A second row holding the same session token is critical even
     // if the table has nothing personal in it at all.
     if (finding.expectation === 'credential') return 'CRITICAL';
-    if (finding.expectation === 'identity') return 'CRITICAL';
+    // Critical only while this column could be the login itself. When the
+    // database has Supabase's auth.users, sign-in goes through that table,
+    // which keeps every email unique - so a duplicate here is a copy that
+    // disagrees with itself, not two accounts sharing one login. Found on a
+    // real app: the report said "two accounts can answer to the same login"
+    // about a profiles table the login never read.
+    if (finding.expectation === 'identity') return finding.loginElsewhere ? 'HIGH' : 'CRITICAL';
     return 'HIGH';
   }
   if (contents.secrets.length) return 'CRITICAL';
@@ -247,6 +261,9 @@ function headlineFor(finding) {
   if (finding.kind === 'duplicated') {
     return 'Your ' + finding.table + ' table lets the same ' + finding.column + ' exist twice.';
   }
+  if (finding.kind === 'privileged') {
+    return 'Anyone on the internet can call your ' + finding.fn + ' function, and it runs with full rights.';
+  }
   if (finding.kind === 'exposed') {
     return 'Your ' + finding.table + ' ' + (finding.isView ? 'view' : 'table') + ' can be read by anyone.';
   }
@@ -263,6 +280,17 @@ const COST_OF_A_DUPLICATE = {
   code: 'A one-time code that can exist twice can be redeemed twice.',
 };
 
+// Said instead of the login sentence when sign-in happens in auth.users.
+const COST_OF_A_COPIED_IDENTITY =
+  'Signing in is not affected: your app signs people in through auth.users, ' +
+  'which keeps each email unique. But anything that looks a person up by this ' +
+  'column can get two rows back and pick the wrong one.';
+
+function costOf(finding) {
+  if (finding.expectation === 'identity' && finding.loginElsewhere) return COST_OF_A_COPIED_IDENTITY;
+  return COST_OF_A_DUPLICATE[finding.expectation] || '';
+}
+
 function bodyFor(finding, contents) {
   const holds = listOf(contents.secrets.concat(contents.identity, contents.money));
   const rowWord = finding.readable === 1 ? 'row' : 'rows';
@@ -300,14 +328,32 @@ function bodyFor(finding, contents) {
       'kept, and your live app was never touched.';
   }
 
+  if (finding.kind === 'privileged') {
+    // Said as what is true, not as what was done - nothing was executed. The
+    // reach is real; whether it is a mistake is the person's to say, so the
+    // wording asks rather than accuses.
+    return (
+      'This function is SECURITY DEFINER, so it runs as whoever created it, not ' +
+      'as the visitor calling it - which means the row level security on the tables ' +
+      'it touches is checked against the owner and skipped for the caller. It is ' +
+      'granted to anon, the role a visitor with no account uses, so anyone on the ' +
+      'internet can call it' +
+      (finding.writes ? ' - and it writes to your data, so a caller can change rows the rules would otherwise protect.'
+                       : ', reaching whatever it reads past the rules on those tables.') +
+      ' I did not call it: whether an open function like this is intended is ' +
+      'something only you can confirm.' +
+      (finding.hasFixedSearchPath ? ''
+        : ' It also does not pin its search_path, so a caller can point the names ' +
+          'inside it at their own objects.')
+    );
+  }
   if (finding.kind === 'duplicated') {
     // Said as what was done, not as what it implies. Two connections, one
     // moment, both accepted, and here is the count afterwards.
     return (
       'I opened two connections to a copy of your app and inserted the same ' +
       finding.column + ' from both at the same moment. Both were accepted, so there are ' +
-      'now ' + finding.copies + ' rows holding the identical value. ' +
-      (COST_OF_A_DUPLICATE[finding.expectation] || '')
+      'now ' + finding.copies + ' rows holding the identical value. ' + costOf(finding)
     ).trim();
   }
 
@@ -368,7 +414,36 @@ function fixPromptFor(finding) {
   const cause = causeOf(finding);
   const owner = finding.owner ? '"' + finding.owner + '"' : 'the column that says who each row belongs to';
 
-  const lines = finding.kind === 'orphaned'
+  const lines = finding.kind === 'privileged'
+    ? [
+      'My app may have a security problem - please check it rather than assume it.',
+      '',
+      'The database function "' + finding.fn + '(' + (finding.args || '') + ')" is SECURITY ' +
+        'DEFINER, so it runs with its owner\'s rights and ignores row level security. It is ' +
+        'granted EXECUTE to "anon", so anyone who is not logged in can call it' +
+        (finding.writes ? ', and it writes to tables.' : '.'),
+      '',
+      'First tell me: is it meant to be callable by logged-out visitors? If it is not, ' +
+        'REVOKE EXECUTE ON FUNCTION "' + finding.fn + '"(' + (finding.args || '') + ') FROM anon, PUBLIC, ' +
+        'and GRANT EXECUTE only to the role that should run it - usually service_role, the ' +
+        'backend key, the way an admin-only function like this should be reached.',
+      '',
+    ].concat(
+      finding.hasFixedSearchPath
+        ? []
+        : [
+          'It also does not set a fixed search_path. Add SET search_path = pg_catalog, public (or ' +
+            'the schemas it truly needs) so a caller cannot make it resolve names to their own objects.',
+          '',
+        ],
+      [
+        'If it is meant to be public, keep it, but make sure everything inside it checks what the ' +
+          'caller is allowed to see or change itself - the table rules will not do it here.',
+        '',
+        'Then look at every other SECURITY DEFINER function for the same grant.',
+      ],
+    )
+    : finding.kind === 'orphaned'
     ? [
       'My app has a data problem.',
       '',
@@ -418,17 +493,50 @@ function fixPromptFor(finding) {
         '". I proved it by inserting the same value from two connections at the same ' +
         'moment, and both were accepted.',
       '',
-      'Add a unique constraint on "' + finding.table + '"."' + finding.column +
-        '" in the database itself. Checking in application code before inserting is not ' +
-        'enough - between the check and the insert, the other request has already gone in.',
+      // First, because it has to happen before anything is changed. Learned
+      // by applying the short version of this prompt literally to a real app:
+      // the constraint cannot be created while duplicates exist, and an
+      // assistant told only "add a constraint" may delete rows to get there.
+      'First, find the rows that already share a value and show them to me. Do not ' +
+        'delete or merge any of them without asking me: the rule below cannot be ' +
+        'created while they exist, and deleting rows to make it pass loses real data.',
+      '',
+      (finding.expectation === 'identity'
+        ? 'Then add a unique index on lower("' + finding.column + '"), so that "' + finding.table +
+          '"."' + finding.column + '" is unique whatever the case - Ann@example.com and ' +
+          'ann@example.com are the same person.'
+        : 'Then add a unique constraint on "' + finding.table + '"."' + finding.column + '".') +
+        ' It has to be in the database itself. Checking in application code before inserting ' +
+        'is not enough - between the check and the insert, the other request has already gone in.',
       '',
       // Said because the obvious fix is wrong for multi-tenant apps, and being
       // told to drop a legitimate design would cost them more than the bug.
-      'If the same value is allowed to repeat for different owners, make the constraint ' +
-        'cover both columns together rather than leaving it off.',
+      'If the same value is allowed to repeat for different owners, make it cover both ' +
+        'columns together rather than leaving it off.',
       '',
-      'Then look for the same missing constraint on every other table and fix those too.',
-    ]
+    ].concat(
+      [
+        'Find everything that writes this column - app code, and any database trigger or ' +
+          'function, such as one that copies each new sign-up into this table - and make ' +
+          'sure each one handles "this value already exists" instead of failing. If people ' +
+          'can edit this column themselves, decide whether they should: once it is unique, ' +
+          'someone who puts another person\'s value in first will block that person.',
+        '',
+      ],
+      finding.expectation === 'identity' && finding.loginElsewhere
+        ? [
+          'Sign-in uses auth.users, so this column is only a copy of the email there. ' +
+            'Consider not letting people edit it at all and keeping it in step with auth.users.',
+          '',
+        ]
+        : [],
+      [
+        'Afterwards, sign up a brand-new account and edit an existing profile to make sure ' +
+          'both still work, and run this check again.',
+        '',
+        'Then look for the same missing constraint on every other table and fix those too.',
+      ],
+    )
     : finding.isView
       ? [
         'My app has a security problem.',
@@ -471,7 +579,15 @@ function describe(finding) {
   const cause = causeOf(finding);
   return {
     severity: severityOf(finding, contents),
-    table: finding.table,
+    // Every other finding here was proven by an attack that ran; this is the
+    // one the tool reasons about without executing, so it says so. The report
+    // and the re-check both read this: a "verification required" finding is
+    // never counted towards a clean re-check on its own.
+    status: finding.kind === 'privileged' ? 'verification required' : 'confirmed',
+    table: finding.kind === 'privileged' ? finding.fn : finding.table,
+    fn: finding.fn,
+    args: finding.args,
+    writes: finding.writes,
     kind: finding.kind,
     // Carried through because a table can have two different columns that each
     // accept a duplicate, and the re-check tells one finding from another by
@@ -483,10 +599,15 @@ function describe(finding) {
     expectation: finding.expectation,
     headline: headlineFor(finding, contents),
     body: bodyFor(finding, contents),
-    cause: cause.long,
+    // For a privileged function there is no "why the door is open" the way a
+    // table has one; the body already carries the whole explanation, so the
+    // cause line would only repeat it. Left empty and skipped by the report.
+    cause: finding.kind === 'privileged' ? '' : cause.long,
     who: finding.who,
     can: finding.can,
-    proof: finding.kind === 'duplicated'
+    proof: finding.kind === 'privileged'
+      ? 'I did not call "' + finding.fn + '". This is a reach that exists in the grants, not a break I ran.'
+      : finding.kind === 'duplicated'
       ? 'I created ' + finding.copies + ' rows in "' + finding.table + '" holding the same ' +
         finding.column + '.'
       : finding.countOnly
@@ -524,7 +645,7 @@ function describeAll(findings) {
   // ones that need an account, and those before the ones that need two requests
   // to arrive together.
   // Writes above reads: a table somebody emptied is worse than one they read.
-  const byKind = { writable: 0, exposed: 1, crossed: 2, duplicated: 3, orphaned: 4 };
+  const byKind = { writable: 0, exposed: 1, crossed: 2, duplicated: 3, orphaned: 4, privileged: 5 };
   const rank = (d) => (d.severity === 'CRITICAL' ? 0 : 1) * 10 + (byKind[d.kind] === undefined ? 9 : byKind[d.kind]);
   return described.sort((a, b) => rank(a) - rank(b));
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "kryptheon-night",
-  "version": "0.1.8",
+  "version": "0.1.9",
   "description": "Attacks a copy of your Supabase database and tells you in plain English what got in.",
   "license": "MIT",
   "type": "commonjs",
@@ -31,7 +31,7 @@
     "node": ">=18.0.0"
   },
   "scripts": {
-    "check": "node package.check.js && node store.check.js && node trouble.check.js && node intro.check.js && node finding.check.js && node outside.check.js && node recheck.check.js && node untouched.check.js && node blocked.check.js && node orphans.check.js && node guests.check.js && node usable.check.js && node twin.check.js && node engines.check.js && node external.check.js && node schema.check.js && node collision.check.js && node tamper.check.js && node orphan.check.js && node shapes.check.js && node verdicts.check.js && node shop.check.js && node loop.check.js",
+    "check": "node package.check.js && node store.check.js && node trouble.check.js && node intro.check.js && node finding.check.js && node outside.check.js && node recheck.check.js && node untouched.check.js && node blocked.check.js && node orphans.check.js && node guests.check.js && node usable.check.js && node twin.check.js && node engines.check.js && node external.check.js && node schema.check.js && node collision.check.js && node tamper.check.js && node orphan.check.js && node shapes.check.js && node verdicts.check.js && node shop.check.js && node privileged.check.js && node cli.check.js && node loop.check.js",
     "check:dry": "node package.check.js && node store.check.js && node trouble.check.js && node intro.check.js && node finding.check.js && node recheck.check.js && node outside.check.js",
     "check:package": "node package.check.js",
     "check:store": "node store.check.js",
@@ -52,6 +52,8 @@
     "check:shapes": "node shapes.check.js",
     "check:verdicts": "node verdicts.check.js",
     "check:shop": "node shop.check.js",
+    "check:privileged": "node privileged.check.js",
+    "check:cli": "node cli.check.js",
     "check:writes": "node tamper.check.js",
     "check:orphans": "node orphans.check.js",
     "probe:write": "node probe-write.js",

package/recheck.js

@@ -116,6 +116,9 @@ function compare(before, after) {
     stillOpen: stillOpen,
     unverifiable: unverifiable,
     newlyBroken: newlyBroken,
+    // Carried so the re-check can say why there is no green light when the
+    // only thing standing in the way is what could not be tested.
+    untested: skipped,
     // Green is the strictest thing this program says, so it is the hardest to
     // earn: everything that was wrong is now provably right, nothing new broke,
     // and nothing at all was left untested.
@@ -208,6 +211,18 @@ function describe(result) {
     lines.push('');
   }
 
+  // Found on a real app: "1 problem is fixed", nothing else, and a non-zero
+  // exit with no word about why. The reason was parts of the app that could
+  // not be tested - which has to be said, or the exit code reads as a bug.
+  const untested = result.untested || [];
+  if (untested.length) {
+    lines.push('  No green light yet: ' + untested.length + ' ' +
+      (untested.length === 1 ? 'part of your app was' : 'parts of your app were') +
+      ' not tested this time, so I cannot');
+    lines.push('  call it clear. They are listed at the end, with the reason for each.');
+    lines.push('');
+  }
+
   return lines;
 }
 

package/scan.js

@@ -344,13 +344,41 @@ async function scan(client, sourceSchema, options) {
       }
     }
 
+    // Where people actually sign in decides how bad a duplicate email is. On
+    // Supabase that is auth.users, which keeps emails unique; a public table's
+    // email column is then a copy. Only read, never written.
+    const loginElsewhere = (await client.query("select to_regclass('auth.users') is not null as found")).rows[0].found;
+    const raced = collisions.findings.map((f) =>
+      f.expectation === 'identity' ? Object.assign({}, f, { loginElsewhere: loginElsewhere }) : f,
+    );
+
+    // Functions an anonymous visitor can call that run past the rules. Read
+    // from the shape, not attacked: nothing is executed, because whether such
+    // a function is meant to be public is a question only the owner answers.
+    //
+    // Every definer function read this run counts as examined, whether or not
+    // anon can call it. That is what lets the re-check call a revoked grant
+    // fixed: the function was looked at again and the reach was gone. The first
+    // version recorded only the flagged ones, so a revoke made the function
+    // vanish from both lists and the fix came back as "could not confirm".
+    for (const fn of plan.anonFunctions || []) attempted.push('privileged:' + fn.name);
+    const privileged = (plan.anonFunctions || []).filter((fn) => fn.callable).map((fn) => ({
+      kind: 'privileged',
+      fn: fn.name,
+      table: fn.name,
+      args: fn.args,
+      writes: fn.writes,
+      hasFixedSearchPath: fn.hasFixedSearchPath,
+      columns: [],
+    }));
+
     return {
       stopped: null,
       attacksRun: attempted.length,
       notChecked: notChecked,
       attempted: attempted,
       findings: finding.describeAll(
-        impersonation.findings.concat(writes.findings, stranded.findings, collisions.findings),
+        impersonation.findings.concat(writes.findings, stranded.findings, raced, privileged),
       ),
     };
   } finally {
@@ -363,6 +391,17 @@ async function scan(client, sourceSchema, options) {
   }
 }
 
+/**
+ * The exit code of a first run: 2 could not run, 1 something got through, 0
+ * every attack lost. Only confirmed findings count as "got through" - a
+ * function flagged for verification was never executed, and a script reading
+ * 1 would act on a break nobody demonstrated.
+ */
+function exitCodeFor(result) {
+  if (result.stopped) return 2;
+  return (result.findings || []).some((f) => f.status !== 'verification required') ? 1 : 0;
+}
+
 /** The last run, or null if there has not been one worth keeping. */
 function loadLastRun(file) {
   try {
@@ -477,18 +516,29 @@ function report(result) {
 
   sayWhatWasMissed();
 
-  const count = result.findings.length;
+  // Confirmed breaks and things that only need a look are not the same claim,
+  // so they are counted apart. Saying "3 problems" when one of them was never
+  // executed is the kind of overstatement that costs the next report its trust.
+  const confirmed = result.findings.filter((f) => f.status !== 'verification required');
+  const toVerify = result.findings.filter((f) => f.status === 'verification required');
   line('');
-  line('  ' + count + (count === 1 ? ' problem' : ' problems') + ' found.');
+  if (confirmed.length) {
+    line('  ' + confirmed.length + (confirmed.length === 1 ? ' problem' : ' problems') + ' found.');
+  }
+  if (toVerify.length) {
+    line('  ' + toVerify.length + ' thing' + (toVerify.length === 1 ? '' : 's') +
+      ' to check - I did not attack ' + (toVerify.length === 1 ? 'it' : 'them') + ', only spotted the risk.');
+  }
 
   for (const item of result.findings) {
     line('');
     line('  ' + '-'.repeat(68));
-    line('  ' + item.severity + '   ' + item.table);
+    line('  ' + item.severity + '   ' + item.table +
+      (item.status === 'verification required' ? '   (verification required)' : ''));
     line('');
     line('  ' + item.headline);
     line('');
-    for (const paragraph of [item.body, item.cause]) {
+    for (const paragraph of [item.body, item.cause].filter(Boolean)) {
       wrap(paragraph, 70).forEach((l) => line('  ' + l));
       line('');
     }
@@ -587,7 +637,7 @@ async function main() {
       // Three answers, three codes: 0 clean, 1 problems found, 2 could not
       // run. A scan that stopped used to exit 0 with no findings, which is
       // what any script watching it would read as a pass.
-      process.exitCode = result.stopped ? 2 : result.findings.length ? 1 : 0;
+      process.exitCode = exitCodeFor(result);
       return;
     }
 
@@ -596,6 +646,7 @@ async function main() {
     recheck.badgeLines(verdict, result.attacksRun || 0).forEach(line);
     // The verdict says what changed; this says what to do about what did not.
     if (result.findings.length) report(result);
+    else notTestedLines(result).forEach(line);
     saveRun(file, result);
     process.exitCode = result.stopped ? 2 : verdict.allClear ? 0 : 1;
   } finally {
@@ -621,5 +672,6 @@ module.exports = {
   sweepOldCopies: sweepOldCopies,
   notTestedLines: notTestedLines,
   lastRunFile: lastRunFile,
+  exitCodeFor: exitCodeFor,
   ABANDONED_AFTER: ABANDONED_AFTER,
 };