GHSA-cwwm-hr97-qfxm

Impact

On schemas involving arrows with caveats on the arrow’ed relation, when the path to resolve a CheckPermission request involves the evaluation of multiple caveated branches, requests may return a negative response when a positive response is expected.

For example, given this schema:

definition user {}

definition office {
    relation parent: office
    relation manager: user
    permission read = manager + parent->read
}

definition group {
    relation parent: office
    permission read = parent->read
}

definition document {
    relation owner: group with equals
    permission read = owner->read
}

caveat equals(actual string, required string) {
    actual == required
}

and these relationships:

office:headoffice#manager@user:maria
office:branch1#parent@office:headoffice
group:admins#parent@office:branch1
group:managers#parent@office:headoffice
document:budget#owner@group:admins[equals:{"required":"admin"}]
document:budget#owner@group:managers[equals:{"required":"manager"}]

Permission for 'document:budget#read@user:maria with {"actual" : "admin"}' is returned as NOPERMISSION when HASPERMISSION is the correct answer.

Patches

Upgrade to v1.44.2.

Workarounds

Do not use caveats in your schema over an arrow’ed relation.