Repository navigation
security(policy): row-filter claim templates fail open on _eq/_neq/_gt/_lt when the claim is missing — only _in fails closed #385
Description
Activity
🔗 Related PRs
#172 - feat(rbac)!: fail-closed authorization + default_role public access [closed]
#330 - fix(pipes): escape non-scalar param values [closed]
#357 - fix(policy): case-normalize aggregation before denied_aggregations check [merged]
#358 - fix(policy): enforce _in on filter and check paths [merged]
#378 - feat(auth): non-JWT operator key for admin + break-glass access [merged]
🧪 Issue enrichment is currently in open beta.
You can configure auto-planning by selecting labels in the issue_enrichment configuration.
To disable automatic issue enrichment, add the following to your
.coderabbit.yaml:issue_enrichment: auto_enrich: enabled: false
💬 Have feedback or questions? Drop into our discord!
Escalated to P0 on the launch board (was P1). This is the fail-open row-level-security class the launch rubric gates the tag on (cf. #223): an unresolvable
{{ jwt.* }}claim renders to""and still emits a real predicate, so_neq/_gt/_lton a string column (col != '') match ~all rows and the RLS restriction evaporates — a data-exposure default, andaccess-control.mdxdocuments the opposite. Only_inwas fixed (#224 → #358);_eq/_neq/_gt/_ltstill fail open. Flagging as av0.1.0-alpha.1flip-blocker per the #149 launch triage.- moved this from Ready to In progress in WaveHouse Task Board
on Aug 12, 2026
Summary
An unresolvable
{{ jwt.* }}template in a policy row-filter renders as the empty string and emits a real predicate against'', instead of denying. Only_inwas given the fail-closed treatment (#224);_eq/_neq/_gt/_ltfail open.Detail
internal/policy/policy.go:resolveTemplate(:266-279) returns""when a claim path can't be resolved.resolveFilters(:226-244) binds that""directly for_eq/_neq/_gt/_lt._inalone emits1 = 0for an empty/unresolvable set (:248-253).Example policy:
select: { user: { filter: { tenant_id: { _eq: "{{ jwt.tenant_id }}" } } } }. A validly-signed token withrole: userbut notenant_idclaim (mixed IdP audiences, service tokens) yieldsWHERE tenant_id = ''→ leaks every row whosetenant_idis empty. Worse,_neq/_gton a string column (col != ''/col > '') matches essentially all rows — the restriction evaporates entirely.The docs promise the opposite:
docs/src/content/docs/access-control.mdx:233says an unresolvable claim "matches no tenant and sees nothing" — only true for_intoday.Fix direction
When a filter template resolves to empty (claim absent), fail closed (
1 = 0) rather than binding'', matching the_inbehavior and the documented contract.Found in a repo-wide audit; verified by code trace. Sibling of closed #224 (which fixed only
_in) and #371 (check-path operators, not the filter path).