Actually, this is a security issue. My initial evaluation was wrong. Because you could have hooks running resource actions with authorize?: false, and have been relying on the update policies to prevent those side effects. I will issue a CVE for affected AshPostgres versions when I am back at my computer in a few hours, and I will also see if there is a way to programmatically identify actions that may have been affected.
zachdaniel
Creator of Ash
0
zachdaniel
Creator of Ash
rapidfsub
rapidfsub
1) test ash_postgres test complex policy with nested resources (SonetLib.Ash.Policies.CommonTest)
test/sonet_lib/ash/policies/common_test.exs:119
** (Ash.Error.Unknown) Unknown Error
* %Postgrex.Error{message: nil, postgres: %{code: :undefined_table, line: "1452", message: "relation \"product\" does not exist", position: "56", file: "parse_relation.c", unknown: "ERROR", severity: "ERROR", pg_code: "42P01", routine: "parserOpenTable"}, connection_id: 73416, query: "SELECT p0.\"id\", p0.\"is_adult_only\", p0.\"store_id\" FROM \"product\" AS p0 WHERE (p0.\"id\"::uuid = $1::uuid) AND ((CASE WHEN NOT (p0.\"is_adult_only\"::boolean) THEN $2 ELSE ash_raise_error($3::jsonb) END))"}
(ecto_sql 3.12.1) lib/ecto/adapters/sql.ex:1096: Ecto.Adapters.SQL.raise_sql_call_error/1
(ecto_sql 3.12.1) lib/ecto/adapters/sql.ex:994: Ecto.Adapters.SQL.execute/6
(ecto 3.12.4) lib/ecto/repo/queryable.ex:232: Ecto.Repo.Queryable.execute/4
(ecto 3.12.4) lib/ecto/repo/queryable.ex:19: Ecto.Repo.Queryable.all/3
(ash_postgres 2.4.10) lib/data_layer.ex:1365: AshPostgres.DataLayer.update_query/4
(ash 3.4.35) lib/ash/actions/update/bulk.ex:537: Ash.Actions.Update.Bulk.do_atomic_update/5
(ash 3.4.35) lib/ash/actions/update/bulk.ex:266: Ash.Actions.Update.Bulk.run/6
(ash 3.4.35) lib/ash/actions/update/update.ex:158: Ash.Actions.Update.run/4
(ash 3.4.35) lib/ash.ex:2665: Ash.update/3
(ash 3.4.35) lib/ash/actions/managed_relationships.ex:1397: Ash.Actions.ManagedRelationships.handle_update/9
(ash 3.4.35) lib/ash/actions/managed_relationships.ex:735: anonymous fn/10 in Ash.Actions.ManagedRelationships.manage_relationship/7
(elixir 1.17.0) lib/enum.ex:4858: Enumerable.List.reduce/3
(elixir 1.17.0) lib/enum.ex:2585: Enum.reduce_while/3
(ash 3.4.35) lib/ash/actions/managed_relationships.ex:732: Ash.Actions.ManagedRelationships.manage_relationship/7
(ash 3.4.35) lib/ash/actions/managed_relationships.ex:554: anonymous fn/4 in Ash.Actions.ManagedRelationships.manage_relationships/4
(elixir 1.17.0) lib/enum.ex:4858: Enumerable.List.reduce/3
(elixir 1.17.0) lib/enum.ex:2585: Enum.reduce_while/3
(ash 3.4.35) lib/ash/actions/update/update.ex:639: Ash.Actions.Update.manage_relationships/4
(ash 3.4.35) lib/ash/actions/update/update.ex:503: anonymous fn/5 in Ash.Actions.Update.commit/3
(ash 3.4.35) lib/ash/changeset/changeset.ex:3848: Ash.Changeset.run_around_actions/2
stacktrace:
(ecto_sql 3.12.1) lib/ecto/adapters/sql.ex:1096: Ecto.Adapters.SQL.raise_sql_call_error/1
(ecto_sql 3.12.1) lib/ecto/adapters/sql.ex:994: Ecto.Adapters.SQL.execute/6
(ecto 3.12.4) lib/ecto/repo/queryable.ex:232: Ecto.Repo.Queryable.execute/4
(ecto 3.12.4) lib/ecto/repo/queryable.ex:19: Ecto.Repo.Queryable.all/3
(ash_postgres 2.4.10) lib/data_layer.ex:1365: AshPostgres.DataLayer.update_query/4
(ash 3.4.35) lib/ash/actions/update/bulk.ex:537: Ash.Actions.Update.Bulk.do_atomic_update/5
(ash 3.4.35) lib/ash/actions/update/bulk.ex:266: Ash.Actions.Update.Bulk.run/6
(ash 3.4.35) lib/ash/actions/update/update.ex:158: Ash.Actions.Update.run/4
(ash 3.4.35) lib/ash.ex:2665: Ash.update/3
(ash 3.4.35) lib/ash/actions/managed_relationships.ex:1397: Ash.Actions.ManagedRelationships.handle_update/9
(ash 3.4.35) lib/ash/actions/managed_relationships.ex:735: anonymous fn/10 in Ash.Actions.ManagedRelationships.manage_relationship/7
(elixir 1.17.0) lib/enum.ex:4858: Enumerable.List.reduce/3
(elixir 1.17.0) lib/enum.ex:2585: Enum.reduce_while/3
(ash 3.4.35) lib/ash/actions/managed_relationships.ex:732: Ash.Actions.ManagedRelationships.manage_relationship/7
(ash 3.4.35) lib/ash/actions/managed_relationships.ex:554: anonymous fn/4 in Ash.Actions.ManagedRelationships.manage_relationships/4
(elixir 1.17.0) lib/enum.ex:4858: Enumerable.List.reduce/3
(elixir 1.17.0) lib/enum.ex:2585: Enum.reduce_while/3
(ash 3.4.35) lib/ash/actions/update/update.ex:639: Ash.Actions.Update.manage_relationships/4
(ash 3.4.35) lib/ash/actions/update/update.ex:503: anonymous fn/5 in Ash.Actions.Update.commit/3
(ash 3.4.35) lib/ash/changeset/changeset.ex:3848: Ash.Changeset.run_around_actions/2
But another weird error is raised.
Not a forbidden error.
0
zachdaniel
Creator of Ash
Okay, this is a separate issue that I will address in the morning as well (luckily not another security related one). In that particular place the schema is not being added to the query.
0
zachdaniel
Creator of Ash
I was unable to reproduce this. I’m using your repository against the latest ash and ash_postgres. Can you confirm that this occurs in the repo that you provided? Did you have to change it in some way to see that behavior?
0
rapidfsub
policy action(:purchase) do
# access_type :strict
forbid_unless actor_present()
authorize_if expr(not is_adult_only or ^actor(:age) >= 19)
end
You need to comment out access_type :strict in Product policy.
0
zachdaniel
Creator of Ash
zachdaniel
Creator of Ash