Vulnerable code sample

import flask
from flask import request, jsonify

# This is a minimal Flask application to demonstrate the logic of the vulnerability
# described in CVE-2026-55664. It is not the actual Grist source code but
# represents the flawed logic.

app = flask.Flask(__name__)

# --- Mock Database and Data Structures ---
# This simulates a Grist document with tables, columns, and simplified access rules.
MOCK_DOCUMENT_DB = {
    "doc_alpha": {
        "widgets": {
            # This widget is a table that should be private
            "widget_sensitive_employees": {
                "type": "table",
                "tableId": "table_employees"
            },
            # This widget is a table that is public
            "widget_public_products": {
                "type": "table",
                "tableId": "table_products"
            }
        },
        "tables": {
            "table_employees": {
                "columns": [
                    {"id": "col_name", "label": "Name"},
                    {"id": "col_ssn", "label": "SSN"},
                    {"id": "col_salary", "label": "Salary"}
                ]
            },
            "table_products": {
                "columns": [
                    {"id": "col_prod_name", "label": "Product"},
                    {"id": "col_price", "label": "Price"}
                ]
            }
        },
        # Simplified access rules: 'user_public' can only read 'table_products'.
        # An admin or owner would have full access (not shown for simplicity).
        "access_rules": {
            "user_public": {
                "permissions": ["table_products"]
            }
        }
    }
}

# --- Vulnerable Endpoint ---
# This endpoint is intended to provide metadata for "forms", but has two flaws:
# 1. It doesn't check if the requested widget is actually a form.
# 2. It bypasses access control checks, directly accessing table metadata.

@app.route('/forms', methods=['GET'])
def get_forms():
    """
    Vulnerable endpoint that reveals schema of any table, regardless of access rules.
    
    To exploit, a user with partial access (e.g., public) would request the
    metadata for a widget they are not supposed to see.

    Example of legitimate use (by a public user):
    GET /forms?docId=doc_alpha&sectionId=widget_public_products

    Example of exploit (by the same public user):
    GET /forms?docId=doc_alpha&sectionId=widget_sensitive_employees
    """
    doc_id = request.args.get('docId')
    section_id = request.args.get('sectionId') # In reality, this is a widget ID

    if not doc_id or not section_id:
        return jsonify({"error": "docId and sectionId are required"}), 400

    doc = MOCK_DOCUMENT_DB.get(doc_id)
    if not doc:
        return jsonify({"error": "Document not found"}), 404

    widget = doc["widgets"].get(section_id)
    if not widget:
        return jsonify({"error": "Section or widget not found"}), 404

    # --- THE VULNERABILITY ---
    # The code proceeds without checking if the user has rights to view this section.
    # It also doesn't verify that widget['type'] is 'form'.
    # It directly looks up the table metadata using the ID from the widget.
    
    table_id = widget.get('tableId')
    if not table_id:
        return jsonify({"error": "Widget is not associated with a table"}), 400
        
    table_metadata = doc["tables"].get(table_id)

    if not table_metadata:
        return jsonify({"error": "Associated table not found"}), 404

    # The sensitive metadata (column structure) is returned to the user,
    # bypassing any access rules defined for the document.
    return jsonify({
        "tableId": table_id,
        "columns": table_metadata["columns"]
    })

if __name__ == '__main__':
    # To run this example:
    # 1. pip install Flask
    # 2. python your_script_name.py
    # 3. In another terminal, use curl to test the vulnerability:
    #    # This call is allowed for a public user
    #    curl "http://127.0.0.1:5000/forms?docId=doc_alpha&sectionId=widget_public_products"
    #    # This call is NOT allowed, but the vulnerability reveals the sensitive schema
    #    curl "http://127.0.0.1:5000/forms?docId=doc_alpha&sectionId=widget_sensitive_employees"
    app.run(debug=True)