Skip to content

CatalogArrayPaths.md

Latest commit

 

History

History
22 lines (16 loc) · 2.97 KB

CatalogArrayPaths.md

File metadata and controls

22 lines (16 loc) · 2.97 KB
Raw

Sensitive catalog paths over actual arrays

Authorization REQ-AUTH-006 / AC-AUTH-006 require a single meaning for escaped, nested and array field paths. RFC 6901 section 4 distinguishes literal object member names from array indices: an array index is zero or ASCII digits beginning with a nonzero digit.

The source-confirmed scalar reader admitted array token 00 as index zero, while the protected-field overlap check kept 00 distinct from 0. A predicate could therefore inspect a protected value using an unprotected spelling. Separately the output projector's default integer parser admitted leading zeros, signs and whitespace, removing different fields from those named by the persisted catalog.

Use the same concrete array-index recognizer in scalar reads and output removal, only after recognizing an actual array. Keep object keys 00, +0, -0, whitespace and oversized numeric text literal; keep wildcard handling, pointer escaping, array bounds, distinct Missing values and validation/error order. Overflow and noncanonical array tokens remain missing/nonmatching paths. No globally normalized policy paths, new packages, schema changes, serialized contracts, migration or fallback are required.

The whole operation starts with a real committed escaped/nested document and persisted sensitive-field catalog. Canonical protected predicate use refuses PermissionDenied. Every alternative array spelling returns no rows, with full point/query output checked independently against complete literal JSON and redacted-field arrays. The same spellings address actual object properties successfully. A persisted use-only grant repairs canonical predicate admission while retaining redaction; a persisted read grant restores raw output. Each read/refusal/replay independently checks the full store image and position even if its primary assertions fail. The complete original command receipt and stored outcome replay before and after two joined same-root reopen cycles, with exact complete serialized StoreIdentity conservation. A public field patch preserves the existing catalog byte-for-byte; its full receipt and healthy revision are checked and replayed.

This packet proves the array-path correction in operation source, not completion of the whole catalog feature. Existing privileged schema/CAS/version/cursor checks remain required. Public UI and transport schema are N/A for this private traversal correction. Zero-segment Encode callers were inspected separately; no root/empty-key encoding change is included without a demonstrated caller violation.

flowchart LR
    Path[Requested field path] --> Kind{Actual array?}
    Kind -->|array| Index[Canonical RFC 6901 index recognizer]
    Kind -->|object| Literal[Literal member name]
    Index --> Policy[Persisted sensitive-field catalog]
    Literal --> Policy
    Policy -->|protected and not granted| Deny[PermissionDenied or redacted output]
    Policy -->|granted| Value[Authorized value]
Loading