Impact
Any user making use of a wildcard relationship under the right hand branch of an exclusion or within an intersection operation will see Lookup/LookupResources return a resource as "accessible" if it is not accessible by virtue of the inclusion of the wildcard in the intersection or the right side of the exclusion.
For example, given schema:
definition user {}
definition resource {
relation viewer: user
relation banned: user | user:*
permission view = viewer - banned
}
If user:* is placed into the banned relation for a particular resource, view should return false for all resources. in v1.3.0, the wildcard is ignored entirely in lookup's dispatch, resulting in the banned wildcard being ignored in the exclusion.
Workarounds
Don't make use of wildcards on the right side of intersections or within exclusions.
References
authzed/spicedb#358
For more information
If you have any questions or comments about this advisory:
References
vroldanbet Analyst
Impact
Any user making use of a wildcard relationship under the right hand branch of an
exclusionor within anintersectionoperation will seeLookup/LookupResourcesreturn a resource as "accessible" if it is not accessible by virtue of the inclusion of the wildcard in the intersection or the right side of the exclusion.For example, given schema:
If
user:*is placed into thebannedrelation for a particular resource,viewshould return false for all resources. inv1.3.0, the wildcard is ignored entirely in lookup's dispatch, resulting in thebannedwildcard being ignored in the exclusion.Workarounds
Don't make use of wildcards on the right side of intersections or within exclusions.
References
authzed/spicedb#358
For more information
If you have any questions or comments about this advisory:
References