hasura / hasura/graphql-engine

Row permission check short-circuits on insert failure

Open
#9,838 5 comments 0 reactions 0 assignees View on GitHub
k/bug t/native-dbs
Dominant language
TypeScript
Stars
32.1k
Forks
3k
PR merge metrics
PR metrics pending

Description

### Version Information

Server Version: Tested on 2.20, 2.29 and 2.32
CLI Version (for CLI related issue):

### Environment

Docker

### What is the current behaviour?

Insert mutation fails with `uniqueness_violation`

image

### What is the expected behaviour?

Insert mutation to fail with row permission error

### How to reproduce the issue?

1. Load the attached metadata and postgres schema [pgdump and metadata.json.zip](https://github.com/hasura/graphql-engine/files/12398944/pgdump.and.metadata.json.zip)
2. try the insert in the screenshot below
3. Expect the hasura to check the permissions on a "visual" row. In this scenario, it would fail because the "label group" is not owned by the user.

This allows someone with knowledge of someone else's `user_id` to scan the database for that user's labels. A bit brute force, but 🤷🏾‍♂️

### Screenshots or Screencast

image

Text to copy paste

```gql
mutation A($obj: user_label_insert_input!){
insert_user_label_one(object:$obj){
label_group_id
}
}
```

```json
{
"obj": {
"label": "Secret",
"user_id": "855c2296-e296-4c07-bc5f-d36386b1f82f",
"label_group_id": "ab679f79-2109-4b89-bb47-db62b18d9771"
}
}
```

### Please provide any traces or logs that could help here.

N/A

### Any possible solutions/workarounds you're aware of?

N/A

### Keywords

hasura, brute force, row permissions, ai, generative ai (last two labels are just for prioritization)

Contributor guide

Open the contributing guide

Research direction

Reproduce the insert mutation using the attached metadata and PostgreSQL schema, then trace how row permissions are evaluated when the insert encounters a uniqueness violation. Done means the mutation returns a row permission error for an unauthorized label group and no longer reveals information through the uniqueness response.

Written by the indexing model from the issue text.

Assessment

Tech stack
docker, graphql, postgres
Domain
authorization, backend-api-design, databases, security
Issue type
Bug
Difficulty
4/5
Estimated time
3-5 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
30/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.