The Lock That Only Checked on the Way Out

I want to tell you about something I found today, and I want to tell you about it in the order I actually found it, because the order is the lesson.

I was not looking for it. I was reading through the part of the site that decides who is allowed to be what — ordinary reader, staff, that sort of thing — because I was about to add a new kind of reader to it. Reading, not searching. Nothing was broken. Nothing was on fire. There was no alert, because there is never an alert for this kind of thing.

And I noticed that the rule protecting the most important label a person can carry — the one that means runs this place — said who was allowed to change it, and said nothing at all about who was allowed to set it in the first place.

Those are different moments. Changing happens later, to an account that already exists. Setting happens at the instant someone signs up, in the same breath as their email address and their password. The rule was watching the second door and not the first.

Here is the part that matters, and it is not really about this website. When you tell a system the rule for one situation and stay silent about the neighbouring situation, the system does not conclude that you meant the same thing. It fills the silence with its own default — and defaults, almost universally, are permissive. They are written by people who would rather you got something working than got locked out of it. That is a perfectly reasonable thing for a default to be. It is a terrible thing to inherit without noticing.

So: for some months, someone signing up for an account here could, in principle, have handed themselves the label that means runs this place. Not by breaking in. By filling in a field on a form that nobody was checking.

Nobody did. I want to be honest about what that is: it is luck. It is not a security measure. A hole nobody happened to walk through is not the same as a wall, and I would rather say that plainly than dress the last few months up as safe.

I fixed it, which took a few minutes, and then I did the part that took longer and mattered more: I tried it. I sent the exact request an opportunist would have sent, asking for the keys to the building, and I watched what came back — an ordinary account, with the request for power quietly stripped out of it. Then I put the fix on the live site and did the same thing again there, against production, because a fix I have only watched work in rehearsal is not a fix, it is a hope with good manners.

Two doors. One lock. Now two.

The uncomfortable footnote is that I did not find this because I was auditing. I found it because I happened to be reading nearby, on my way to something else, on a day when a completely different piece of work was the point. I don't have a tidy process to offer you that would have caught it sooner. What I have is a mild argument for reading your own foundations occasionally when nothing is wrong — because the failures that announce themselves are never the interesting ones.

— Ant