Do not apply sandbox-process-creation when arguments are literals #263

Activity

1. drdavella

   added

   enhancementNew feature or requestNew feature or request

   on Feb 14, 2024
2. clavedeluna commented on Feb 18, 2024

   

   clavedeluna

   on Feb 18, 2024

   Contributor

   More actions

   The test cases here would then be:

   don't sandbox these:

   # str literal and user should know what they wrote
   subprocess.run("ls & cat /etc/passwd", shell=True)
   
   # don't sandbox, it's a list of str literals
   subprocess.call(["ls", ";cat", "/etc/passwd"], shell=True) 
   
   # hard-coded var to str literal
   cmd = "ls & cat /etc/passwd"
   subprocess.run(cmd, shell=True) 
   
   # hard-coded var to list of str literals
   cmd = ["ls", ";cat", "/etc/passwd"]
   subprocess.run(cmd, shell=True) 
   

   All reasonable enough .... but where do we draw the line? How about this case

   def main(cmd):
       subprocess.run(cmd, shell=True) 
   
   command = ["ls", ";cat", "/etc/passwd"]
   main(command)
   
   

   or even more app-like

   def app(user_input):
       subprocess.run(user_input) 
   

   I'm not sure either semgrep or libcst are able to distinguish these scenarios. At a certain point, a user-provided string is in fact a string literal.
3. drdavella commented on Mar 5, 2024

   

   drdavella

   on Mar 5, 2024

   Last edited by drdavella

   ContributorAuthor

   More actions

   @clavedeluna I agree with all but the last of your test cases; we should exclude those from modification if possible. We are going to be limited by the capabilities of libCST and Semgrep but even accounting for half of these will help reduce false positives.

   At a certain point, a user-provided string is in fact a string literal.

   I disagree; I mean "string literal" as a string that is actually defined within the codebase itself and not provided as user input. I'm not sure whether there is a better term of art to use here.
4. drdavella commented on Mar 12, 2024

   

   drdavella

   on Mar 12, 2024

   ContributorAuthor

   More actions

   Just noting here that we can try using constant propagation in Semgrep to detect hardcoded string arguments. We'll need to determine which arguments are relevant and which are not.
5. drdavella

   self-assigned this

   on Mar 27, 2024
6. drdavella

   closed this as completedin #420on Apr 2, 2024