fix: enforce per-database access in HTTP command handler

lvca · lvca · commit a28b5da98fdb · 2026-04-20T12:05:36.000-04:00
Security fix reported
diff --git a/server/src/main/java/com/arcadedb/server/http/handler/DatabaseAbstractHandler.java b/server/src/main/java/com/arcadedb/server/http/handler/DatabaseAbstractHandler.java
@@ -63,6 +63,10 @@ public ExecutionResponse execute(final HttpServerExchange exchange, final Server
       if (databaseName.isEmpty())
         return new ExecutionResponse(400, "{ \"error\" : \"Database parameter is null\"}");
 
+      if (user != null && !user.canAccessToDatabase(databaseName.getFirst()))
+        throw new SecurityException(
+            "User '" + user.getName() + "' is not allowed to access database '" + databaseName.getFirst() + "'");
+
       database = httpServer.getServer().getDatabase(databaseName.getFirst(), false, false);
 
       current = DatabaseContext.INSTANCE.getContextIfExists(database.getDatabasePath());
diff --git a/server/src/main/java/com/arcadedb/server/security/ServerSecurityDatabaseUser.java b/server/src/main/java/com/arcadedb/server/security/ServerSecurityDatabaseUser.java
@@ -40,11 +40,18 @@ public class ServerSecurityDatabaseUser implements SecurityDatabaseUser {
   private              long        resultSetLimit    = -1;
   private              long        readTimeout       = -1;
   private final        boolean[]   databaseAccessMap = new boolean[DATABASE_ACCESS.values().length];
+  private final        boolean     denyAll;
 
   public ServerSecurityDatabaseUser(final String databaseName, final String userName, final String[] groups) {
+    this(databaseName, userName, groups, false);
+  }
+
+  public ServerSecurityDatabaseUser(final String databaseName, final String userName, final String[] groups,
+      final boolean denyAll) {
     this.databaseName = databaseName;
     this.userName = userName;
     this.groups = groups;
+    this.denyAll = denyAll;
   }
 
   public String[] getGroups() {
@@ -77,11 +84,16 @@ public String getDatabaseName() {
 
   @Override
   public boolean requestAccessOnDatabase(final DATABASE_ACCESS access) {
+    if (denyAll)
+      return false;
     return databaseAccessMap[access.ordinal()];
   }
 
   @Override
   public boolean requestAccessOnFile(final int fileId, final ACCESS access) {
+    if (denyAll)
+      return false;
+
     final boolean[][] currentMap = fileAccessMap;
     if (currentMap == null)
       return true;
diff --git a/server/src/main/java/com/arcadedb/server/security/ServerSecurityUser.java b/server/src/main/java/com/arcadedb/server/security/ServerSecurityUser.java
@@ -92,8 +92,9 @@ else if (userDatabases.has(SecurityManager.ANY))
     }
 
     if (dbu == null)
-      // USER HAS NO ACCESS TO THE DATABASE, RETURN A USER WITH NO AX
-      dbu = new ServerSecurityDatabaseUser(databaseName, name, new String[0]);
+      // USER HAS NO ACCESS TO THE DATABASE: deny-all sentinel so record/database operations are rejected even if the
+      // caller bypasses the handler-level canAccessToDatabase gate.
+      dbu = new ServerSecurityDatabaseUser(databaseName, name, new String[0], true);
 
     final ServerSecurityDatabaseUser prev = databaseCache.putIfAbsent(databaseName, dbu);
     if (prev != null)
diff --git a/server/src/test/java/com/arcadedb/server/SelectOrderTest.java b/server/src/test/java/com/arcadedb/server/SelectOrderTest.java
@@ -156,7 +156,7 @@ void ridOrdering() {
         database.commit();
 
         sqlString = "SELECT from Order WHERE @rid < ? ORDER BY @rid DESC LIMIT 10";
-        parameter = new RID(database, "#3:1");
+        parameter = new RID("#3:1");
 
         database.begin();
         try (ResultSet resultSet = database.query("sql", sqlString, parameter)) {
diff --git a/server/src/test/java/com/arcadedb/server/security/CrossDatabaseAccessIT.java b/server/src/test/java/com/arcadedb/server/security/CrossDatabaseAccessIT.java
@@ -0,0 +1,256 @@
+/*
+ * Copyright © 2021-present Arcade Data Ltd (info@arcadedata.com)
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ *
+ * SPDX-FileCopyrightText: 2021-present Arcade Data Ltd (info@arcadedata.com)
+ * SPDX-License-Identifier: Apache-2.0
+ */
+package com.arcadedb.server.security;
+
+import com.arcadedb.serializer.json.JSONArray;
+import com.arcadedb.serializer.json.JSONObject;
+import com.arcadedb.server.BaseGraphServerTest;
+import org.junit.jupiter.api.Test;
+
+import java.net.HttpURLConnection;
+import java.net.URL;
+import java.util.Base64;
+
+import static org.assertj.core.api.Assertions.assertThat;
+
+/**
+ * Regression test for the authorization bypass where an authenticated user or API token scoped to a single database could
+ * still read/write records on any other database on the same server.
+ *
+ * Root cause: {@code ServerSecurityUser.getDatabaseUser()} used to return a database user with an uninitialized
+ * {@code fileAccessMap} when the database was not in the user's allowed list. The null map was then interpreted as
+ * allow-all in {@code ServerSecurityDatabaseUser.requestAccessOnFile()}, silently bypassing per-database scoping.
+ */
+class CrossDatabaseAccessIT extends BaseGraphServerTest {
+
+  private static final String OTHER_DB = "otherdb";
+
+  @Test
+  void scopedUserCannotReadOtherDatabase() throws Exception {
+    testEachServer((serverIndex) -> {
+      createDatabase(serverIndex, OTHER_DB);
+      try {
+        createType(serverIndex, OTHER_DB, "Memory");
+        final String userAuth = createScopedUser(serverIndex, "scoped-reader", "secret-pwd-1");
+
+        final int status = commandStatus(serverIndex, OTHER_DB, userAuth, "SELECT FROM Memory");
+        assertThat(status).as("scoped user must not SELECT on an unrelated database").isGreaterThanOrEqualTo(400);
+      } finally {
+        dropUser(serverIndex, "scoped-reader");
+        dropDatabase(serverIndex, OTHER_DB);
+      }
+    });
+  }
+
+  @Test
+  void scopedUserCannotWriteOtherDatabase() throws Exception {
+    testEachServer((serverIndex) -> {
+      createDatabase(serverIndex, OTHER_DB);
+      try {
+        createType(serverIndex, OTHER_DB, "Memory");
+        final String userAuth = createScopedUser(serverIndex, "scoped-writer", "secret-pwd-2");
+
+        final int status = commandStatus(serverIndex, OTHER_DB, userAuth,
+            "INSERT INTO Memory SET leaked = true");
+        assertThat(status).as("scoped user must not INSERT on an unrelated database").isGreaterThanOrEqualTo(400);
+      } finally {
+        dropUser(serverIndex, "scoped-writer");
+        dropDatabase(serverIndex, OTHER_DB);
+      }
+    });
+  }
+
+  @Test
+  void scopedApiTokenCannotReadOtherDatabase() throws Exception {
+    testEachServer((serverIndex) -> {
+      createDatabase(serverIndex, OTHER_DB);
+      try {
+        createType(serverIndex, OTHER_DB, "Memory");
+        final String tokenAuth = "Bearer " + createReadOnlyToken(serverIndex, "scoped-token-read");
+
+        final int status = commandStatus(serverIndex, OTHER_DB, tokenAuth, "SELECT FROM Memory");
+        assertThat(status).as("scoped API token must not SELECT on an unrelated database").isGreaterThanOrEqualTo(400);
+      } finally {
+        deleteToken(serverIndex, "scoped-token-read");
+        dropDatabase(serverIndex, OTHER_DB);
+      }
+    });
+  }
+
+  @Test
+  void scopedApiTokenCannotWriteOtherDatabase() throws Exception {
+    testEachServer((serverIndex) -> {
+      createDatabase(serverIndex, OTHER_DB);
+      try {
+        createType(serverIndex, OTHER_DB, "Memory");
+        final String tokenAuth = "Bearer " + createCrudToken(serverIndex, "scoped-token-crud");
+
+        final int status = commandStatus(serverIndex, OTHER_DB, tokenAuth,
+            "INSERT INTO Memory SET leaked = true");
+        assertThat(status).as("scoped API token must not INSERT on an unrelated database").isGreaterThanOrEqualTo(400);
+      } finally {
+        deleteToken(serverIndex, "scoped-token-crud");
+        dropDatabase(serverIndex, OTHER_DB);
+      }
+    });
+  }
+
+  private String createScopedUser(final int serverIndex, final String name, final String password) throws Exception {
+    if (getServer(serverIndex).getSecurity().existsUser(name))
+      getServer(serverIndex).getSecurity().dropUser(name);
+
+    final JSONObject payload = new JSONObject();
+    payload.put("name", name);
+    payload.put("password", password);
+    payload.put("databases", new JSONObject().put(getDatabaseName(), new JSONArray().put("admin")));
+
+    final HttpURLConnection connection = open(serverIndex, "/api/v1/server/users", "POST", basicAuth());
+    connection.setDoOutput(true);
+    connection.setRequestProperty("Content-Type", "application/json");
+    connection.getOutputStream().write(payload.toString().getBytes());
+    connection.connect();
+    try {
+      assertThat(connection.getResponseCode()).isEqualTo(201);
+    } finally {
+      connection.disconnect();
+    }
+    return "Basic " + Base64.getEncoder().encodeToString((name + ":" + password).getBytes());
+  }
+
+  private void dropUser(final int serverIndex, final String name) {
+    try {
+      if (getServer(serverIndex) != null && getServer(serverIndex).getSecurity().existsUser(name))
+        getServer(serverIndex).getSecurity().dropUser(name);
+    } catch (final Exception ignore) {
+    }
+  }
+
+  private String createReadOnlyToken(final int serverIndex, final String name) throws Exception {
+    final JSONObject permissions = new JSONObject()
+        .put("types", new JSONObject()
+            .put("*", new JSONObject().put("access", new JSONArray().put("readRecord"))))
+        .put("database", new JSONArray());
+    return createToken(serverIndex, name, permissions);
+  }
+
+  private String createCrudToken(final int serverIndex, final String name) throws Exception {
+    final JSONObject permissions = new JSONObject()
+        .put("types", new JSONObject()
+            .put("*", new JSONObject().put("access",
+                new JSONArray().put("createRecord").put("readRecord").put("updateRecord").put("deleteRecord"))))
+        .put("database", new JSONArray());
+    return createToken(serverIndex, name, permissions);
+  }
+
+  private String createToken(final int serverIndex, final String name, final JSONObject permissions) throws Exception {
+    final ApiTokenConfiguration tokenConfig = getServer(serverIndex).getSecurity().getApiTokenConfiguration();
+    tokenConfig.listTokens().stream()
+        .filter(t -> name.equals(t.getString("name", "")))
+        .forEach(t -> tokenConfig.deleteToken(t.getString("tokenHash")));
+
+    final HttpURLConnection connection = open(serverIndex, "/api/v1/server/api-tokens", "POST", basicAuth());
+    connection.setDoOutput(true);
+    connection.setRequestProperty("Content-Type", "application/json");
+
+    final JSONObject payload = new JSONObject();
+    payload.put("name", name);
+    payload.put("database", getDatabaseName());
+    payload.put("expiresAt", 0);
+    payload.put("permissions", permissions);
+    connection.getOutputStream().write(payload.toString().getBytes());
+    connection.connect();
+
+    try {
+      assertThat(connection.getResponseCode()).isEqualTo(201);
+      return new JSONObject(readResponse(connection)).getJSONObject("result").getString("token");
+    } finally {
+      connection.disconnect();
+    }
+  }
+
+  private void deleteToken(final int serverIndex, final String name) {
+    try {
+      final ApiTokenConfiguration tokenConfig = getServer(serverIndex).getSecurity().getApiTokenConfiguration();
+      tokenConfig.listTokens().stream()
+          .filter(t -> name.equals(t.getString("name", "")))
+          .forEach(t -> tokenConfig.deleteToken(t.getString("tokenHash")));
+    } catch (final Exception ignore) {
+    }
+  }
+
+  private void createDatabase(final int serverIndex, final String database) throws Exception {
+    final HttpURLConnection connection = open(serverIndex, "/api/v1/server", "POST", basicAuth());
+    connection.setDoOutput(true);
+    connection.setRequestProperty("Content-Type", "application/json");
+    connection.getOutputStream().write(new JSONObject().put("command", "create database " + database).toString().getBytes());
+    connection.connect();
+    try {
+      assertThat(connection.getResponseCode()).isEqualTo(200);
+    } finally {
+      connection.disconnect();
+    }
+  }
+
+  private void dropDatabase(final int serverIndex, final String database) {
+    try {
+      final HttpURLConnection connection = open(serverIndex, "/api/v1/server", "POST", basicAuth());
+      connection.setDoOutput(true);
+      connection.setRequestProperty("Content-Type", "application/json");
+      connection.getOutputStream().write(new JSONObject().put("command", "drop database " + database).toString().getBytes());
+      connection.connect();
+      try {
+        connection.getResponseCode();
+      } finally {
+        connection.disconnect();
+      }
+    } catch (final Exception ignore) {
+    }
+  }
+
+  private void createType(final int serverIndex, final String database, final String typeName) throws Exception {
+    final int status = commandStatus(serverIndex, database, basicAuth(), "CREATE DOCUMENT TYPE " + typeName);
+    assertThat(status).isEqualTo(200);
+  }
+
+  private int commandStatus(final int serverIndex, final String database, final String auth, final String sql) throws Exception {
+    final HttpURLConnection connection = open(serverIndex, "/api/v1/command/" + database, "POST", auth);
+    connection.setDoOutput(true);
+    connection.setRequestProperty("Content-Type", "application/json");
+    final JSONObject payload = new JSONObject().put("language", "sql").put("command", sql);
+    connection.getOutputStream().write(payload.toString().getBytes());
+    connection.connect();
+    try {
+      return connection.getResponseCode();
+    } finally {
+      connection.disconnect();
+    }
+  }
+
+  private HttpURLConnection open(final int serverIndex, final String path, final String method, final String auth)
+      throws Exception {
+    final HttpURLConnection connection = (HttpURLConnection) new URL("http://127.0.0.1:248" + serverIndex + path).openConnection();
+    connection.setRequestMethod(method);
+    connection.setRequestProperty("Authorization", auth);
+    return connection;
+  }
+
+  private String basicAuth() {
+    return "Basic " + Base64.getEncoder().encodeToString(("root:" + DEFAULT_PASSWORD_FOR_TESTS).getBytes());
+  }
+}
