Add optional data access edges for Read, Write, and Delete - #26
Open
jazofra wants to merge 5 commits into
Open
Conversation
Introduce three non-traversable, opt-in edges that surface principals who can read, write, or delete data in a database (previously only the traversable MSSQL_ControlDB edge connected principals to databases): - MSSQL_ReadDB <- SELECT on the database / db_datareader fixed role - MSSQL_WriteDB <- INSERT or UPDATE on the database / db_datawriter - MSSQL_DeleteDB <- DELETE on the database / db_datawriter Creation is gated behind the new --enable-data-access-edges flag (off by default) so existing output is unchanged. Sources are explicit DATABASE-scoped grants in sys.database_permissions and the db_datareader/db_datawriter fixed roles. Registers the edge kinds, marks them non-traversable, adds property generators, schema and seed-data entries, config plumbing, unit tests (positive, negative, and flag-off cases), and README docs. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01K5TQ7KrD4DuRdFvQ56ChbM
…-edges-hhr8i3 Add opt-in data-access edges (ReadDB/WriteDB/DeleteDB)
The --enable-data-access-edges example was placed after the closing code fence, causing the shell-comment lines to render as markdown headings. Move it inside the fenced bash block with the other examples. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01K5TQ7KrD4DuRdFvQ56ChbM
Resolve conflicts with upstream's AD-edges refactor and version bump: - Take upstream version 2.0.4 - Keep the new --enable-data-access-edges flag in the Collection annotation group - Keep upstream's updated --skip-ad-nodes README comment, plus the --enable-data-access-edges usage example - Adapt writeDataAccessEdge to the new edgeSink interface introduced upstream Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01K5TQ7KrD4DuRdFvQ56ChbM
…-edges-hhr8i3 Claude/database read write delete edges hhr8i3
Contributor
Author
|
Fine from my side @Mayyhem! |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Today the only edge that terminates on an MSSQL_Database node representing elevated access is MSSQL_ControlDB (traversable, created from CONTROL on the database or the db_owner fixed role). I want to also surface principals that can read, write, or delete data in a database: a weaker but still security-relevant capability. These new edges must be non-traversable (they are informational, not privilege-escalation paths) and their creation must be opt-in via a new flag so existing output is unchanged by default.