Fix two Datalog injection authorization bypasses; release 0.4.0

[sunilp]

Summary

Two authorization bypasses, both caused by building Biscuit Datalog with string interpolation. Present identically in the Python and Rust SDKs, with forged tokens portable between them.

F1 — authorizer injection in ChainedToken.authorize(). The requested tool name was interpolated into the authorizer source. A tool name that closed its own string could append an in-allowlist tool() fact and allow if true, so a token granting only tool:search authorized any tool.

This required no malicious token, no forged signature and no control of the issuer, only influence over the tool name being checked. In an MCP binding that name arrives directly from the agent's JSON-RPC params.name.

control: legitimate  tool:search     -> AUTHORIZED
control: unauthorized admin:wipe     -> denied (scope_insufficient)
INJECTION payload                    -> AUTHORIZED     <-- before
INJECTION payload                    -> denied         <-- after

F2 — block-encoder injection in create_authority() and delegate(). The issuer, principal, scope, delegator, delegate and context values were interpolated into block Datalog, so a breakout in any of them injected facts into a block that was then signed:

identity("aip:web:x");
tool("tool:search");      <-- injected, satisfies the scope check for ANY tool
max_depth(99);            <-- injected, read by V3's first-match parser
identity("aip:web:x");
right("tool:search");
max_depth(1);             <-- the real one, never reached
check if tool($t), ["tool:search"].contains($t);

That token is cryptographically valid, every signature chains, and it authorizes everything.

Fix

validate_term() rejects the double quote, the backslash and control characters at every boundary where a caller-supplied string becomes Datalog. Those are the only characters that can escape a Datalog string context. Semicolons, parentheses, brackets, commas, //, spaces, colons and non-ASCII characters round-trip unambiguously and keep working, so ordinary identifiers and free-form context are unaffected.

authorize() additionally binds the tool as a Datalog parameter rather than interpolating it.

Also in this release

SimplePolicy.to_datalog() emitted check if budget($b), $b <= N and check if depth($d), $d <= N in both SDKs. Section 3.4.1 of draft-prakash-aip-01 requires these as the facts budget_ceiling(N) and max_depth(N), and forbids a budget check outright: it binds to whatever budget facts are in scope at evaluation rather than to the block's own ceiling, so it either rejects valid chains or passes unconditionally.

The chained builders were already correct. SimplePolicy had drifted because the canonical encoding was implemented twice per SDK. It now lives in one module per language (aip_token.canonical, aip_token::canonical).

Note: both SDKs agreed with each other and both violated the spec, so cross-language interop tests passed the whole time. The test that catches this asserts the spec's MUST NOT directly.

Verification

• Python: 194 passed
• Rust: 80 passed, 0 failed
• Cross-language conformance: 26 passed

New: regression tests for both bypasses in each language, and conformance vectors comparing the Rust and Python renderings byte for byte.

The one pre-existing Python failure (test_adk_adapter.py::test_register_walks_sub_agents) is unrelated and reproduces on master without these changes.

Breaking

• SimplePolicy.to_datalog() output has changed to the canonical Section 3.4.1 form.
• Identifiers, scopes and context containing a double quote, backslash or control characters are now rejected with token_malformed.

[coderabbitai]

Important

• 🔍 Trigger review

This repository does not receive automatic reviews because it has fewer than 10 stars.

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro Plus

Run ID: 9a0555d4-f180-4ad5-9f95-73757b73dce1

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}