GHSA-xh55-3p42-7v2h: 
Python vulnerability analysis and mitigation

Impact

Strawberry granted access whenever a permission's has_permission returned a truthy value. Some return values can't be evaluated as a permission decision but are always truthy, so the protected field or mutation ran even when the permission meant to deny access. This happens when has_permission is written as an async generator (an async def that uses yield) or a generator (a def that uses yield), or when it returns an async generator or other non-boolean object. It affects queries and mutations under both execute_sync and execute. Applications are only affected if they have a permission class written this way. Permissions that return True/False, or are async def functions that return a boolean, are not affected.

Patches

Fixed in 0.338.0 (#4764). has_permission must now return, or resolve to, a boolean. Any other value raises PermissionReturnedNonBooleanError instead of granting access. This is a breaking change for permissions that return other truthy or falsy values, such as a user object or None. Wrap those results in bool(...) to keep the same behaviour. See the 0.338.0 breaking changes guide.

Workarounds

Make sure every has_permission method returns True or False (or is an async def that returns one) and does not use yield.