mssql: its handlers, tools and provisioner run in the node's runtime, through the driver in its bundle (hq ADR 0198)
The mesh-mssql container goes with its Dockerfile (and the sqlcmd it fetched), build bases and bus credential. The client speaks TDS through the mssql driver its package.json names, inlined into the bundle by the builder (ADR 0198 §4): one session per call as one sqlcmd invocation was, FOR JSON rendering rows exactly as before, the consumer's password checked as a bound parameter. A caller's statement still runs only as the reader login (issue 193); the one-line rule and -x guarded against sqlcmd's own commands and variable substitution, which no longer stand between the caller and the server. The server is reached on loopback at the port the machine published (${port:1433}). The reader test drives a fake session in place of a fake sqlcmd.
This commit is contained in:
jochen
@@ -1,96 +1,83 @@
|
||||
// What holds mssql_query to being read-only (novox/hq issue 193): a caller's statement runs as the
|
||||
// reader login and never as the administrator, with sqlcmd's variable substitution off, on one line
|
||||
// that follows the module's own — a line break is refused before sqlcmd starts — and with no
|
||||
// transaction wrapped around it as text. Without the reader's password the statement is refused.
|
||||
// reader login and never as the administrator, with no transaction wrapped around it as text, and
|
||||
// without the reader's password the statement is refused.
|
||||
//
|
||||
// sqlcmd is a fake on PATH that records each call's login, flags and text. That the reader cannot
|
||||
// write is the server's to enforce and was proven against a real server; this holds the module to
|
||||
// asking for it. Run against the compiled module (npm test builds first), the way the runtime loads it.
|
||||
// The driver is a fake session that records each call's login, database, text and bound
|
||||
// parameters. That the reader cannot write is the server's to enforce and was proven against a real
|
||||
// server; this holds the module to asking for it. Run against the compiled module (npm test builds
|
||||
// first), the way the runtime loads it.
|
||||
|
||||
import { test, before, after } from "node:test";
|
||||
import { test } from "node:test";
|
||||
import assert from "node:assert/strict";
|
||||
import { chmod, mkdtemp, readFile, rm, writeFile } from "node:fs/promises";
|
||||
import { tmpdir } from "node:os";
|
||||
import { join } from "node:path";
|
||||
|
||||
import { MssqlClient, READER } from "../dist/client.js";
|
||||
import { MssqlClient, READER, type Connect, type Target } from "../dist/client.js";
|
||||
|
||||
let dir: string;
|
||||
let log: string;
|
||||
const originalPath = process.env.PATH;
|
||||
interface Call extends Target {
|
||||
text: string;
|
||||
params: Record<string, string>;
|
||||
}
|
||||
|
||||
before(async () => {
|
||||
dir = await mkdtemp(join(tmpdir(), "mssql-reader-"));
|
||||
log = join(dir, "calls.jsonl");
|
||||
await writeFile(join(dir, "sqlcmd"), `#!/usr/bin/env node
|
||||
const fs = require("node:fs");
|
||||
const args = process.argv.slice(2);
|
||||
const at = (flag) => args[args.indexOf(flag) + 1];
|
||||
fs.appendFileSync(${JSON.stringify(log)}, JSON.stringify({
|
||||
user: at("-U"), database: at("-d"), sql: at("-Q"), noVariables: args.includes("-x"),
|
||||
password: process.env.SQLCMDPASSWORD,
|
||||
}) + "\\n");
|
||||
const sql = at("-Q");
|
||||
if (/FROM sys.server_principals/.test(sql)) process.stdout.write("");
|
||||
else if (/FOR JSON/.test(sql)) process.stdout.write('[{"name":"alpha","n":1}]\\n');
|
||||
`);
|
||||
await chmod(join(dir, "sqlcmd"), 0o755);
|
||||
process.env.PATH = `${dir}:${originalPath}`;
|
||||
});
|
||||
|
||||
after(async () => {
|
||||
process.env.PATH = originalPath;
|
||||
await rm(dir, { recursive: true, force: true });
|
||||
});
|
||||
|
||||
async function calls(): Promise<Record<string, unknown>[]> {
|
||||
const text = await readFile(log, "utf8").catch(() => "");
|
||||
await writeFile(log, "");
|
||||
return text.split("\n").filter(Boolean).map((line) => JSON.parse(line));
|
||||
function recording(): { connect: Connect; calls: Call[] } {
|
||||
const calls: Call[] = [];
|
||||
const connect: Connect = async (to) => ({
|
||||
async run(text, params = {}) {
|
||||
calls.push({ ...to, text, params });
|
||||
if (/FROM sys.server_principals/.test(text)) return [];
|
||||
// FOR JSON answers its document split across rows of one column.
|
||||
if (/FOR JSON/.test(text)) return [{ JSON_F52E: '[{"name":"al' }, { JSON_F52E: 'pha","n":1}]' }];
|
||||
return [];
|
||||
},
|
||||
async close() {},
|
||||
});
|
||||
return { connect, calls };
|
||||
}
|
||||
|
||||
const conn = { host: "127.0.0.1", port: 1433, user: "sa", password: "admin-secret" };
|
||||
|
||||
test("a caller's statement runs as the reader, without variables, on the module's first line", async () => {
|
||||
const client = new MssqlClient({ ...conn, readerPassword: "reader-secret" });
|
||||
test("a caller's statement runs as the reader, as it was written, on the database it names", async () => {
|
||||
const { connect, calls } = recording();
|
||||
const client = new MssqlClient({ ...conn, readerPassword: "reader-secret" }, connect);
|
||||
const result = await client.readOnlyQuery("inventory", "SELECT '$(SQLCMDPASSWORD)' AS p");
|
||||
|
||||
const asked = (await calls()).at(-1)!;
|
||||
const asked = calls.at(-1)!;
|
||||
assert.equal(asked.user, READER, "the statement never runs as the administrator");
|
||||
assert.equal(asked.password, "reader-secret");
|
||||
assert.equal(asked.noVariables, true, "no $(NAME) is substituted in a caller's text");
|
||||
const [first] = String(asked.sql).split("\n");
|
||||
assert.ok(first.startsWith("SET NOCOUNT ON; SELECT '$(SQLCMDPASSWORD)'"), "the caller's text never begins a line");
|
||||
assert.doesNotMatch(String(asked.sql), /BEGIN TRANSACTION|ROLLBACK/, "no transaction wrapped around it as text");
|
||||
assert.deepEqual(result.rows, [{ name: "alpha", n: 1 }]);
|
||||
assert.equal(asked.database, "inventory");
|
||||
assert.ok(asked.text.startsWith("SET NOCOUNT ON; SELECT '$(SQLCMDPASSWORD)' AS p\nFOR JSON PATH"),
|
||||
"the caller's text reaches the server unaltered");
|
||||
assert.doesNotMatch(asked.text, /BEGIN TRANSACTION|ROLLBACK/, "no transaction wrapped around it as text");
|
||||
assert.deepEqual(result.rows, [{ name: "alpha", n: 1 }], "a FOR JSON document split across rows is reassembled");
|
||||
assert.equal(result.command, "SELECT");
|
||||
});
|
||||
|
||||
test("a line break in a caller's statement is refused before sqlcmd starts", async () => {
|
||||
const client = new MssqlClient({ ...conn, readerPassword: "reader-secret" });
|
||||
for (const sql of ["SELECT 1\n:!! id", "SELECT 1\r\n:!! id", "SELECT 1\r:!! id"]) {
|
||||
await assert.rejects(client.readOnlyQuery("inventory", sql), /must be one line/);
|
||||
}
|
||||
assert.deepEqual(await calls(), []);
|
||||
});
|
||||
|
||||
test("the reader is made as the administrator, kept out of sysadmin, and granted only reading", async () => {
|
||||
const client = new MssqlClient({ ...conn, readerPassword: "reader-secret" });
|
||||
const { connect, calls } = recording();
|
||||
const client = new MssqlClient({ ...conn, readerPassword: "reader-secret" }, connect);
|
||||
await client.readOnlyQuery("inventory", "SELECT 1 AS x");
|
||||
await client.readOnlyQuery("inventory", "SELECT 2 AS x");
|
||||
|
||||
const made = await calls();
|
||||
const asAdmin = made.filter((c) => c.user === "sa").map((c) => String(c.sql));
|
||||
const asAdmin = calls.filter((c) => c.user === "sa").map((c) => c.text);
|
||||
assert.ok(asAdmin.some((s) => s.startsWith(`CREATE LOGIN [${READER}]`)));
|
||||
assert.ok(asAdmin.some((s) => /ALTER SERVER ROLE sysadmin DROP MEMBER/.test(s)));
|
||||
assert.ok(asAdmin.includes(`GRANT CONNECT ANY DATABASE TO [${READER}]`));
|
||||
assert.ok(asAdmin.includes(`GRANT SELECT ALL USER SECURABLES TO [${READER}]`));
|
||||
assert.equal(asAdmin.filter((s) => s.startsWith("CREATE LOGIN")).length, 1, "made once, not per call");
|
||||
assert.equal(made.filter((c) => c.user === READER).length, 2);
|
||||
assert.equal(calls.filter((c) => c.user === READER).length, 2);
|
||||
});
|
||||
|
||||
test("without the reader's password the statement is refused, and nothing runs as the administrator", async () => {
|
||||
const client = new MssqlClient(conn);
|
||||
const { connect, calls } = recording();
|
||||
const client = new MssqlClient(conn, connect);
|
||||
await assert.rejects(client.readOnlyQuery("inventory", "SELECT 1"), /refused rather than run as the administrator/);
|
||||
assert.deepEqual(await calls(), []);
|
||||
assert.deepEqual(calls, []);
|
||||
});
|
||||
|
||||
test("a consumer's password is checked as a bound parameter, never in the text", async () => {
|
||||
const { connect, calls } = recording();
|
||||
const client = new MssqlClient(conn, connect);
|
||||
await client.holdsLogin("shop", "shop_login", "minted-secret");
|
||||
const asked = calls[0];
|
||||
assert.equal(asked.params.meshholdspw, "minted-secret");
|
||||
assert.doesNotMatch(asked.text, /minted-secret/);
|
||||
assert.match(asked.text, /PWDCOMPARE\(@meshholdspw, password_hash\)/);
|
||||
});
|
||||
|
||||
Reference in New Issue
Block a user