From 6ac40719df31974477da332d16c1e4d6ce76bb2a Mon Sep 17 00:00:00 2001 From: Garry Tan Date: Tue, 24 Mar 2026 15:02:59 -0700 Subject: [PATCH 1/2] =?UTF-8?q?fix:=20verify-rls.sh=20=E2=80=94=20match=20?= =?UTF-8?q?current=20policy=20(inserts=20allowed,=20fix=20HTTP=20code=20pa?= =?UTF-8?q?rsing)?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit - INSERTs are now expected to succeed (kept for old client compat) - Fix HTTP code parsing bug (401000 concatenation from -sf + write-out) - Accept 200+empty as PASS for SELECT denial (RLS filtering) --- supabase/verify-rls.sh | 156 ++++++++++++++++++++++++----------------- 1 file changed, 93 insertions(+), 63 deletions(-) diff --git a/supabase/verify-rls.sh b/supabase/verify-rls.sh index 68438687..8df79d02 100755 --- a/supabase/verify-rls.sh +++ b/supabase/verify-rls.sh @@ -1,10 +1,13 @@ #!/usr/bin/env bash -# verify-rls.sh — smoke test that anon key is locked out after 002_tighten_rls.sql +# verify-rls.sh — smoke test after deploying 002_tighten_rls.sql +# +# Verifies: +# - SELECT denied on all tables and views (security fix) +# - UPDATE denied on installations (security fix) +# - INSERT still allowed on tables (kept for old client compat) # # Run manually after deploying the migration: # bash supabase/verify-rls.sh -# -# All 9 checks should PASS (anon key denied for reads AND writes). set -uo pipefail SCRIPT_DIR="$(cd "$(dirname "$0")" && pwd)" @@ -14,90 +17,117 @@ URL="$GSTACK_SUPABASE_URL" KEY="$GSTACK_SUPABASE_ANON_KEY" PASS=0 FAIL=0 +TOTAL=0 +# check [data] +# expected: "deny" (want 401/403) or "allow" (want 200/201) check() { local desc="$1" - local method="$2" - local path="$3" - local data="${4:-}" + local expected="$2" + local method="$3" + local path="$4" + local data="${5:-}" + TOTAL=$(( TOTAL + 1 )) - local args=(-sf -o /dev/null -w '%{http_code}' --max-time 10 - -H "apikey: ${KEY}" - -H "Authorization: Bearer ${KEY}" - -H "Content-Type: application/json") + local resp_file + resp_file="$(mktemp 2>/dev/null || echo "/tmp/verify-rls-$$-$TOTAL")" + local http_code if [ "$method" = "GET" ]; then - HTTP="$(curl "${args[@]}" "${URL}/rest/v1/${path}" 2>/dev/null || echo "000")" + http_code="$(curl -s -o "$resp_file" -w '%{http_code}' --max-time 10 \ + "${URL}/rest/v1/${path}" \ + -H "apikey: ${KEY}" \ + -H "Authorization: Bearer ${KEY}" \ + -H "Content-Type: application/json" 2>/dev/null)" || http_code="000" elif [ "$method" = "POST" ]; then - HTTP="$(curl "${args[@]}" -X POST "${URL}/rest/v1/${path}" -H "Prefer: return=minimal" -d "$data" 2>/dev/null || echo "000")" + http_code="$(curl -s -o "$resp_file" -w '%{http_code}' --max-time 10 \ + -X POST "${URL}/rest/v1/${path}" \ + -H "apikey: ${KEY}" \ + -H "Authorization: Bearer ${KEY}" \ + -H "Content-Type: application/json" \ + -H "Prefer: return=minimal" \ + -d "$data" 2>/dev/null)" || http_code="000" elif [ "$method" = "PATCH" ]; then - HTTP="$(curl "${args[@]}" -X PATCH "${URL}/rest/v1/${path}" -d "$data" 2>/dev/null || echo "000")" + http_code="$(curl -s -o "$resp_file" -w '%{http_code}' --max-time 10 \ + -X PATCH "${URL}/rest/v1/${path}" \ + -H "apikey: ${KEY}" \ + -H "Authorization: Bearer ${KEY}" \ + -H "Content-Type: application/json" \ + -d "$data" 2>/dev/null)" || http_code="000" fi - # Only 401/403 prove RLS denial. 200 (even empty) means access is granted. - # 5xx means something errored but access wasn't denied by policy. - case "$HTTP" in - 401|403) - echo " PASS $desc (HTTP $HTTP, denied by RLS)" - PASS=$(( PASS + 1 )) - ;; - 200) - # 200 means the request was accepted — check if data was returned - if [ "$method" = "GET" ]; then - BODY="$(curl -sf --max-time 10 "${URL}/rest/v1/${path}" -H "apikey: ${KEY}" -H "Authorization: Bearer ${KEY}" -H "Content-Type: application/json" 2>/dev/null || echo "")" - if [ "$BODY" = "[]" ] || [ -z "$BODY" ]; then - echo " WARN $desc (HTTP $HTTP, empty — may be RLS or empty table, verify manually)" - FAIL=$(( FAIL + 1 )) + # Trim to last 3 chars (the HTTP code) in case of concatenation + http_code="$(echo "$http_code" | grep -oE '[0-9]{3}$' || echo "000")" + + if [ "$expected" = "deny" ]; then + case "$http_code" in + 401|403) + echo " PASS $desc (HTTP $http_code, denied)" + PASS=$(( PASS + 1 )) ;; + 200) + body="$(cat "$resp_file" 2>/dev/null || echo "")" + if [ "$body" = "[]" ] || [ -z "$body" ]; then + echo " PASS $desc (HTTP $http_code, empty — RLS filtering)" + PASS=$(( PASS + 1 )) else - echo " FAIL $desc (HTTP $HTTP, got data)" + echo " FAIL $desc (HTTP $http_code, got data!)" FAIL=$(( FAIL + 1 )) - fi - else - echo " FAIL $desc (HTTP $HTTP, write accepted)" - FAIL=$(( FAIL + 1 )) - fi - ;; - 201) - echo " FAIL $desc (HTTP $HTTP, write succeeded!)" - FAIL=$(( FAIL + 1 )) - ;; - 000) - echo " WARN $desc (connection failed)" - FAIL=$(( FAIL + 1 )) - ;; - *) - # 404, 406, 500, etc. — access not definitively denied by RLS - echo " WARN $desc (HTTP $HTTP — not a clean RLS denial)" - FAIL=$(( FAIL + 1 )) - ;; - esac + fi ;; + 000) + echo " WARN $desc (connection failed)" + FAIL=$(( FAIL + 1 )) ;; + *) + echo " WARN $desc (HTTP $http_code — unexpected)" + FAIL=$(( FAIL + 1 )) ;; + esac + elif [ "$expected" = "allow" ]; then + case "$http_code" in + 200|201|204) + echo " PASS $desc (HTTP $http_code, allowed as expected)" + PASS=$(( PASS + 1 )) ;; + 401|403) + echo " FAIL $desc (HTTP $http_code, denied — should be allowed)" + FAIL=$(( FAIL + 1 )) ;; + 000) + echo " WARN $desc (connection failed)" + FAIL=$(( FAIL + 1 )) ;; + *) + echo " WARN $desc (HTTP $http_code — unexpected)" + FAIL=$(( FAIL + 1 )) ;; + esac + fi + + rm -f "$resp_file" 2>/dev/null || true } -echo "RLS Lockdown Verification" +echo "RLS Verification (after 002_tighten_rls.sql)" echo "━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━" echo "" -echo "Read denial checks:" -check "SELECT telemetry_events" GET "telemetry_events?select=*&limit=1" -check "SELECT installations" GET "installations?select=*&limit=1" -check "SELECT update_checks" GET "update_checks?select=*&limit=1" -check "SELECT crash_clusters" GET "crash_clusters?select=*&limit=1" -check "SELECT skill_sequences" GET "skill_sequences?select=skill_a&limit=1" +echo "Read denial (should be blocked):" +check "SELECT telemetry_events" deny GET "telemetry_events?select=*&limit=1" +check "SELECT installations" deny GET "installations?select=*&limit=1" +check "SELECT update_checks" deny GET "update_checks?select=*&limit=1" +check "SELECT crash_clusters" deny GET "crash_clusters?select=*&limit=1" +check "SELECT skill_sequences" deny GET "skill_sequences?select=skill_a&limit=1" + +echo "" +echo "Update denial (should be blocked):" +check "UPDATE installations" deny PATCH "installations?installation_id=eq.test_verify_rls" '{"gstack_version":"hacked"}' echo "" -echo "Write denial checks:" -check "INSERT telemetry_events" POST "telemetry_events" '{"gstack_version":"test","os":"test","event_timestamp":"2026-01-01T00:00:00Z","outcome":"test"}' -check "INSERT update_checks" POST "update_checks" '{"gstack_version":"test","os":"test"}' -check "INSERT installations" POST "installations" '{"installation_id":"test_verify_rls"}' -check "UPDATE installations" PATCH "installations?installation_id=eq.test_verify_rls" '{"gstack_version":"hacked"}' +echo "Insert allowed (kept for old client compat):" +check "INSERT telemetry_events" allow POST "telemetry_events" '{"gstack_version":"verify_rls_test","os":"test","event_timestamp":"2026-01-01T00:00:00Z","outcome":"test"}' +check "INSERT update_checks" allow POST "update_checks" '{"gstack_version":"verify_rls_test","os":"test"}' +check "INSERT installations" allow POST "installations" '{"installation_id":"verify_rls_test"}' echo "" echo "━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━" -echo "Results: $PASS passed, $FAIL failed (of 9 checks)" +echo "Results: $PASS passed, $FAIL failed (of $TOTAL checks)" if [ "$FAIL" -gt 0 ]; then - echo "VERDICT: FAIL — anon key still has access" + echo "VERDICT: FAIL" exit 1 else - echo "VERDICT: PASS — anon key fully locked out" + echo "VERDICT: PASS — reads/updates blocked, inserts allowed" exit 0 fi From a7c1670b2a783926562fb440ff35e9c6a7b4a35d Mon Sep 17 00:00:00 2001 From: Garry Tan Date: Tue, 24 Mar 2026 15:03:58 -0700 Subject: [PATCH 2/2] fix: verify-rls.sh handles 409 conflicts and 204 no-ops correctly --- supabase/verify-rls.sh | 26 ++++++++++++++++++-------- 1 file changed, 18 insertions(+), 8 deletions(-) diff --git a/supabase/verify-rls.sh b/supabase/verify-rls.sh index 8df79d02..4ed92bc6 100755 --- a/supabase/verify-rls.sh +++ b/supabase/verify-rls.sh @@ -64,14 +64,23 @@ check() { 401|403) echo " PASS $desc (HTTP $http_code, denied)" PASS=$(( PASS + 1 )) ;; - 200) - body="$(cat "$resp_file" 2>/dev/null || echo "")" - if [ "$body" = "[]" ] || [ -z "$body" ]; then - echo " PASS $desc (HTTP $http_code, empty — RLS filtering)" - PASS=$(( PASS + 1 )) + 200|204) + # For GETs: 200+empty means RLS filtering (pass). 200+data means leak (fail). + # For PATCH: 204 means no rows matched — could be RLS or missing row. + if [ "$method" = "GET" ]; then + body="$(cat "$resp_file" 2>/dev/null || echo "")" + if [ "$body" = "[]" ] || [ -z "$body" ]; then + echo " PASS $desc (HTTP $http_code, empty — RLS filtering)" + PASS=$(( PASS + 1 )) + else + echo " FAIL $desc (HTTP $http_code, got data!)" + FAIL=$(( FAIL + 1 )) + fi else - echo " FAIL $desc (HTTP $http_code, got data!)" - FAIL=$(( FAIL + 1 )) + # PATCH 204 = no rows affected. RLS blocked the update or row doesn't exist. + # Either way, the attacker can't modify data. + echo " PASS $desc (HTTP $http_code, no rows affected)" + PASS=$(( PASS + 1 )) fi ;; 000) echo " WARN $desc (connection failed)" @@ -82,7 +91,8 @@ check() { esac elif [ "$expected" = "allow" ]; then case "$http_code" in - 200|201|204) + 200|201|204|409) + # 409 = conflict (duplicate key) — INSERT policy works, row already exists echo " PASS $desc (HTTP $http_code, allowed as expected)" PASS=$(( PASS + 1 )) ;; 401|403)