Summary
PermissionExtension.resolve() evaluates the return value of has_permission() for truthiness on the synchronous path. supports_sync only classifies a permission as asynchronous when has_permission is declared with async def (via inspect.iscoroutinefunction), so a plain def that returns an awaitable is treated as synchronous. An awaitable is always truthy, so the check passes even when it resolves to False and the protected resolver runs.
The resolve path is chosen by the field resolver, not by the execution method, so any field with a synchronous resolver is affected under both execute_sync() and execute(). Permissions declared with async def has_permission(), or a plain def returning a boolean, are not affected.
Details
The affected code is PermissionExtension.resolve() in strawberry/permission.py. A permission attached to a field whose has_permission is a normal def returning an awaitable reaches this path; the awaitable is never awaited and its truthiness grants access. resolve_async() is not affected because it uses await_maybe().
PoC
import strawberry
from strawberry.permission import BasePermission
class DenyViaAwaitable(BasePermission):
message = "denied"
def has_permission(self, source, info, **kwargs):
async def result():
return False
return result()
@strawberry.type
class Query:
@strawberry.field(permission_classes=[DenyViaAwaitable])
def secret(self) -> str:
return "secret"
schema = strawberry.Schema(Query)
print(schema.execute_sync("{ secret }").data) # {'secret': 'secret'} instead of a permission errorImpact
An application using a custom permission whose has_permission is a normal def returning an awaitable can unintentionally grant access to the protected field. Standard permissions (a def returning a boolean, or an async def) are not affected, so exploitability depends on the application using this specific permission shape.
Fix
The synchronous path now fails closed: if has_permission() returns an awaitable, an error is raised instead of granting access.
References
Summary
PermissionExtension.resolve()evaluates the return value ofhas_permission()for truthiness on the synchronous path.supports_synconly classifies a permission as asynchronous whenhas_permissionis declared withasync def(viainspect.iscoroutinefunction), so a plaindefthat returns an awaitable is treated as synchronous. An awaitable is always truthy, so the check passes even when it resolves toFalseand the protected resolver runs.The resolve path is chosen by the field resolver, not by the execution method, so any field with a synchronous resolver is affected under both
execute_sync()andexecute(). Permissions declared withasync def has_permission(), or a plaindefreturning a boolean, are not affected.Details
The affected code is
PermissionExtension.resolve()instrawberry/permission.py. A permission attached to a field whosehas_permissionis a normaldefreturning an awaitable reaches this path; the awaitable is never awaited and its truthiness grants access.resolve_async()is not affected because it usesawait_maybe().PoC
Impact
An application using a custom permission whose
has_permissionis a normaldefreturning an awaitable can unintentionally grant access to the protected field. Standard permissions (adefreturning a boolean, or anasync def) are not affected, so exploitability depends on the application using this specific permission shape.Fix
The synchronous path now fails closed: if
has_permission()returns an awaitable, an error is raised instead of granting access.References