🛡️ Sentinel: [HIGH] Fix missing deserialization sinks in taint propagation - #183
🛡️ Sentinel: [HIGH] Fix missing deserialization sinks in taint propagation#183tachyon-beep wants to merge 2 commits into
Conversation
Added `shelve.open`, `dill.load`, `dill.loads`, `jsonpickle.decode`, `joblib.load`, and `torch.load` to `_SERIALISATION_SINKS` to correctly shed validation provenance. Co-authored-by: tachyon-beep <544926+tachyon-beep@users.noreply.github.com>
|
👋 Jules, reporting for duty! I'm here to lend a hand with this pull request. When you start a review, I'll add a 👀 emoji to each comment to let you know I've read it. I'll focus on feedback directed at me and will do my best to stay out of conversations between you and other bots or reviewers to keep the noise down. I'll push a commit with your requested changes shortly after. Please note there might be a delay between these steps, but rest assured I'm on the job! For more direct control, you can switch me to Reactive Mode. When this mode is on, I will only act on comments where you specifically mention me with New to Jules? Learn more at jules.google/docs. For security, I will only act on instructions from the user who triggered this task. |
There was a problem hiding this comment.
🟡 Changes recommended
The newly added sinks are not covered by existing taint-propagation unit tests, increasing regression risk for a security-critical behavior change.
Once you've addressed the issues Copilot identified, you can request another Copilot review.
Pull request overview
This PR strengthens Wardline’s Python taint propagation by extending the _SERIALISATION_SINKS set so additional high-risk (de)serialization APIs are treated as representation-boundary calls and their outputs shed validation provenance (becoming UNKNOWN_RAW). This reduces the risk of false negatives when analyzing flows involving unsafe object deserialization (CWE-502).
Changes:
- Added missing deserialization-related call FQNs to
_SERIALISATION_SINKS(shelve.open,dill.load/loads,jsonpickle.decode,joblib.load,torch.load).
File summaries
| File | Description |
|---|---|
| src/wardline/scanner/taint/variable_level.py | Expands the serialisation/deserialisation sink set so these calls resolve to UNKNOWN_RAW during taint computation. |
Review details
- Files reviewed: 1/1 changed files
- Comments generated: 1
- Review effort level: Lite
💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.
| "shelve.open", | ||
| "dill.load", | ||
| "dill.loads", | ||
| "jsonpickle.decode", | ||
| "joblib.load", |
Added `shelve.open`, `dill.load`, `dill.loads`, `jsonpickle.decode`, `joblib.load`, and `torch.load` to `_SERIALISATION_SINKS` to correctly shed validation provenance. Also fixed linter issues where 5 files were unformatted resulting in CI failure on ruff format --check. Co-authored-by: tachyon-beep <544926+tachyon-beep@users.noreply.github.com>
🚨 Severity: HIGH
💡 Vulnerability: The static analyzer was missing
shelve.open,dill.load,dill.loads,jsonpickle.decode,joblib.load, andtorch.loadin its_SERIALISATION_SINKSmapping.🎯 Impact: The engine could fail to correctly shed validation provenance when tracking untrusted data flowing into these dangerous deserialization functions, leading to false negatives for arbitrary object-graph execution (CWE-502).
🔧 Fix: Added the missing deserialization sinks to
_SERIALISATION_SINKSinsrc/wardline/scanner/taint/variable_level.py. Regenerated golden identity tests to align with the new analysis behavior.✅ Verification: Verified that the new sinks are tracked and golden tests pass.
PR created automatically by Jules for task 3720392675991044704 started by @tachyon-beep