Calendar adversarial range omission and mutation denial status mismatch #1418

Open
opened 2026-10-07 22:56:47 +00:00 by kayg · 0 comments
Owner

Found in the one bounded merge34 / #1403 release-server round. Runtime build is ef0aa12b1; merged Rust changes are tests only. Head d395b6e25d.

Unchanged tests/adversarial/attack2.py calendar-feeds reports:

!! calendar subscription owner layer: User A's range is missing its Journal or subscribed Event
!! calendar feed cross-User rotate: expected 404, got 403 b'{"code":"forbidden","message":"Access denied"}'
!! calendar feed cross-User revoke: expected 404, got 403 b'{"code":"forbidden","message":"Access denied"}'
!! calendar feed cross-User delete: expected 404, got 403 b'{"code":"forbidden","message":"Access denied"}'

The owner-layer check creates a Journal Log dated today and a controlled public-DNS subscription with an Event tomorrow. Creation returns 201. The subsequent Calendar range lacks at least one marker. The probe does not record which marker is missing. Source loss is not established. Investigate projection readiness and fixture state; retain the existing assertion.

Read-only status comparison on the same live server: User B receives exactly the same 403 body above for POST /feeds/merge34-missing-feed/link, DELETE /feeds/merge34-missing-feed/link and DELETE /feeds/merge34-missing-feed. Thus the observed status mismatch is not an existence oracle. Cross-User range and list assertions reported no disclosure, and no foreign mutation succeeded. Earlier XUser matrix passed its ownership comparisons. The plugin handlers themselves specify 404 after owner lookup; investigate the preceding policy guard and fixture permissions before changing the probe.

Non-blocking retrieval/status inconsistencies. No demonstrated data loss, crash, accepted hostile request or authorization hole. Regression coverage already exists in calendar-feeds; do not weaken it to make the round pass.

Found in the one bounded merge34 / #1403 release-server round. Runtime build is ef0aa12b1; merged Rust changes are tests only. Head d395b6e25da20d8c67b8b9fc1a593b813939c8a7. Unchanged tests/adversarial/attack2.py calendar-feeds reports: ``` !! calendar subscription owner layer: User A's range is missing its Journal or subscribed Event !! calendar feed cross-User rotate: expected 404, got 403 b'{"code":"forbidden","message":"Access denied"}' !! calendar feed cross-User revoke: expected 404, got 403 b'{"code":"forbidden","message":"Access denied"}' !! calendar feed cross-User delete: expected 404, got 403 b'{"code":"forbidden","message":"Access denied"}' ``` The owner-layer check creates a Journal Log dated today and a controlled public-DNS subscription with an Event tomorrow. Creation returns 201. The subsequent Calendar range lacks at least one marker. The probe does not record which marker is missing. Source loss is not established. Investigate projection readiness and fixture state; retain the existing assertion. Read-only status comparison on the same live server: User B receives exactly the same 403 body above for POST /feeds/merge34-missing-feed/link, DELETE /feeds/merge34-missing-feed/link and DELETE /feeds/merge34-missing-feed. Thus the observed status mismatch is not an existence oracle. Cross-User range and list assertions reported no disclosure, and no foreign mutation succeeded. Earlier XUser matrix passed its ownership comparisons. The plugin handlers themselves specify 404 after owner lookup; investigate the preceding policy guard and fixture permissions before changing the probe. Non-blocking retrieval/status inconsistencies. No demonstrated data loss, crash, accepted hostile request or authorization hole. Regression coverage already exists in calendar-feeds; do not weaken it to make the round pass.
Commenting is not possible because the repository is archived.
No labels
No milestone
No project
No assignees
1 participant
Due date
The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set

Reference
kayg/calternal-v0#1418
No description provided.