gcp-firestore-public-rules

id: gcp-firestore-public-rules
emits: ExposedToInternet
description: 'Firebase Security Rules containing ''allow read, write: if true'' (or equivalent unauthenticated-access
  rule) make the Firestore database readable/writable by any unauthenticated internet user via the Firebase
  client SDK.'
match_record:
  resource_type: firebase.rules.Ruleset
  field: source.files[].content
where:
- 'Security Rules source contains a match block with ''allow read: if true'', ''allow write: if true'',
  ''allow read, write: if true'', or equivalent (missing ''if'' clause defaults to ''if true'' in some
  Firebase Rules versions)'
- the release named 'cloud.firestore' points to this ruleset (confirmed via firebase.rules.releases.get)
emit:
  source_type: Data
  target_type: AnonymousIdentity
  source: <Firestore Database / NoSQLDatabase node>
  target: <AnonymousIdentity>
  permissions: []
  conditions:
  - resource_policy
  state_logic: ACTIVE when the live ruleset (the release named 'cloud.firestore') contains a permissive
    allow rule with no request.auth check covering at least read OR write access for the matched path;
    CONDITIONAL(resource_policy) when the ruleset source cannot be fully parsed or the matching rule scope
    is unclear (e.g. rules apply only to a subset of collections); BLOCKED when a subsequent rule or condition
    check confirms auth is required for all paths.
  confidence: '0.96'
  derived_from:
  - 'firebase.rules.Ruleset source: allow read/write without request.auth check'
  - firebase.rules.Release 'cloud.firestore' points to this ruleset
  false_positive_note: "CRITICAL DUAL-SURFACE DISTINCTION: Firebase Security Rules govern ONLY the Firebase\
    \ client SDK endpoint. Admin SDK callers (server-to-server with service-account credentials) BYPASS\
    \ Security Rules entirely and are governed by Cloud IAM. A permissive Security Rules ruleset does\
    \ NOT grant unrestricted Cloud IAM access. Only emit ExposedToInternet for the Firebase client endpoint\
    \ surface. Security Rules are evaluated per-path: a permissive rule on /databases/{database}/documents/{document=**}\
    \ covers all documents, but a rule on /databases/{database}/documents/public/{document} covers only\
    \ the 'public' collection. Parse the match paths carefully and emit with CONDITIONAL(resource_policy)\
    \ when the coverage is partial. Firebase test-mode rulesets (generated during project setup) contain\
    \ 'allow read, write: if true' and are the single most common misconfiguration in Firebase apps. Verify\
    \ the ruleset is the currently active release (not a historical or draft ruleset). Firebase App Check\
    \ (when enforced for Firestore) limits client SDK access to attested app instances but does not replace\
    \ auth requirements \u2014 it is a separate control not currently modeled; note as a mitigating factor."
  narrative: 'Firestore database {database.name} is accessible to unauthenticated internet users: the
    active Firebase Security Rules ruleset allows read/write without requiring request.auth (no Firebase
    Auth token needed). Any internet client with the Firebase SDK and project ID can read and/or write
    documents. This is the "test mode" default and a critical misconfiguration for production data.'