Anir0Y

An authorization bypass exists that allows cross-database access through DuckDB table-valued I/O functions. In `internal/api/query.go`, the `extractTableReferences` function skips names followed by an opening parenthesis, and `checkQueryPermissions` allows queries with no extracted table references. While certain patterns are blocked, the system fails to restrict the `parquet scan` alias and functions such as `glob()`, `parquet metadata()`, `parquet schema()`, `read blob()`, `read csv auto()`, `read json()`, and `read text()`. A request to the `POST /api/v1/query` endpoint using these functions can bypass tenant authorization, enabling the reading and enumeration of other databases' time-series data, schemas, and per-column value-range statistics within the allowlisted root. The issue is rooted in how `allowed directories` in `internal/database/sandbox.go` and `GetStoragePath` in `internal/storage/util.go` handle the multi-tenant root.

The default `blockUnsafeOperationsPlugin` compares parsed option names with literal dangerous option spellings, but Git accepts unambiguous long-option abbreviations. This allows attacker-influenced push arguments, such as abbreviated forms of `--receive-pack` or `--exec`, to bypass the `detectVulnerableFlags` function. Consequently, Git may invoke an attacker-selected command when these arguments are passed to a local or file remote, or an attacker-influenced receive-pack target.

An incomplete denylist in the `unsafe git archive options` guard allows attackers to provide the `--add-file` and `--add-virtual-file` options to the `Repo.archive()` function. This can be exploited to read arbitrary files from the filesystem and include them in the generated archive.