🛡️ Sentinel: [HIGH] Fix missing deserialization sinks in taint tracking - #140
🛡️ Sentinel: [HIGH] Fix missing deserialization sinks in taint tracking#140tachyon-beep wants to merge 1 commit into
Conversation
Update `_SERIALISATION_SINKS` to include specific third-party deserialization functions (`dill.load`, `jsonpickle.decode`, etc.) that were added to the `PY-WL-106` rule but omitted from core taint propagation, ensuring validation provenance is correctly shed. Co-authored-by: tachyon-beep <544926+tachyon-beep@users.noreply.github.com>
|
👋 Jules, reporting for duty! I'm here to lend a hand with this pull request. When you start a review, I'll add a 👀 emoji to each comment to let you know I've read it. I'll focus on feedback directed at me and will do my best to stay out of conversations between you and other bots or reviewers to keep the noise down. I'll push a commit with your requested changes shortly after. Please note there might be a delay between these steps, but rest assured I'm on the job! For more direct control, you can switch me to Reactive Mode. When this mode is on, I will only act on comments where you specifically mention me with New to Jules? Learn more at jules.google/docs. For security, I will only act on instructions from the user who triggered this task. |
|
You have reached your Codex usage limits for code reviews. You can see your limits in the Codex usage dashboard. |
There was a problem hiding this comment.
Pull request overview
This PR strengthens Wardline’s level-2 taint tracking by ensuring additional high-risk third-party deserialization APIs are treated as representation-boundary sinks (shedding validation provenance to UNKNOWN_RAW), and updates the PY-WL-106 rule’s clean example to remain non-failing under the new taint behavior.
Changes:
- Added missing third-party deserialization sink names (
dill.load(s),jsonpickle.decode,joblib.load,torch.load,numpy.load) to_SERIALISATION_SINKSso their outputs becomeUNKNOWN_RAW. - Updated the
untrusted_to_deserializationclean example to avoid returning the (nowUNKNOWN_RAW) result ofnumpy.load, preventing a PY-WL-101 finding.
Reviewed changes
Copilot reviewed 2 out of 2 changed files in this pull request and generated 1 comment.
| File | Description |
|---|---|
| src/wardline/scanner/taint/variable_level.py | Extends _SERIALISATION_SINKS to include additional third-party deserialization APIs so taint provenance is shed consistently. |
| src/wardline/scanner/rules/untrusted_to_deserialization.py | Adjusts the clean example to align with the new UNKNOWN_RAW propagation behavior and avoid PY-WL-101. |
💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.
| # numpy.load without allow_pickle=True is safe by default (no object unpickling). | ||
| # We must not return its result directly to avoid a PY-WL-101 finding, as numpy.load | ||
| # is a serialization sink shedding validation provenance. |
🚨 Severity: HIGH
💡 Vulnerability: The static analyzer was missing curated third-party deserialization sinks (
dill.load,jsonpickle.decode,joblib.load,torch.load,numpy.load) in its core taint propagation mapping (_SERIALISATION_SINKS).🎯 Impact: When tracking untrusted data flowing through these dangerous deserialization functions, the analyzer failed to shed validation provenance (convert outputs to
UNKNOWN_RAW), potentially leading to false negatives in security scanning (failing to flag untrusted data reaching trusted tier code via these sinks).🔧 Fix: Added the missing
loadvariants of these sinks to_SERIALISATION_SINKSinsrc/wardline/scanner/taint/variable_level.py. Also adjusted the clean example inuntrusted_to_deserialization.pyto correctly reflect the updatedUNKNOWN_RAWtracking without triggeringPY-WL-101.✅ Verification: Verified by ensuring the updated
test_clean_example_fires_no_defectpasses, meaningnumpy.loadcorrectly propagatesUNKNOWN_RAWtaint and the fix integrates correctly. Regenerated golden identity tests and passed allmake test,make lint, andmake typechecksuites.PR created automatically by Jules for task 3440635421251319783 started by @tachyon-beep