Py: Why a sanitizer blocks a NotNormalized Path before Safe checking it ?

[Sim4n6]

Hey,

To my understanding of the path injection, the only safe case is when the state of the path goes through the following states:

    Path is NotNormaliazed --- NormalizedUnchecked --- (Get SafeChecked)

The problem is within the sanitizer, it contains:

    // Block `NotNormalized` paths here, since they change state to `NormalizedUnchecked`
    node instanceof Path::PathNormalization and state instanceof NotNormalized

So that means a NotNormalized path would get sanitized and blocked without being Safe checked, right? Am I missing something in here, please?

The path state NotNormalized has been switched permanently in the isAdditionalTaintStep() to NormalizedUnchecked. A bit troubled in here? can you please explain?

[Sim4n6]

I'm still interested on understanding this one ... it looks like I am missing a small detail ... can't figure it out. Please let me know if my question is not clear ?

[RasmusWL]

In the additional taint step, we add an EXTRA edge to the taint-tracking graph to the new state. If there was an existing data-flow/taint-tracking edge to/from the same nodes, we would continue tracking with both states.

For example, if there is a general taint-step saying that the output of os.path.abspath is tainted if the first argument is tainted, in the code below, we would have that norm on the second line would be considered BOTH NormalizedUnchecked and NotNormalized, which is obviously wrong.

source # NotNormalized
norm = os.path.abspath(source) # norm is NormalizedUnchecked
if norm.startswith(f"{ROOT}/user_uploads/"):
    open(norm) # flow to norm is blocked
else:
    open(norm) # unsafe, norm is NormalizedUnchecked

[Sim4n6]

You got me reading your reply three times. Thanks @RasmusWL

[Sim4n6]

By the way, for debugging reasons, what are the ways to visualize the taint tracking graph (edges/nodes)? thx

[RasmusWL]

By the way, for debugging reasons, what are the ways to visualize the taint tracking graph (edges/nodes)? thx

Open a new question instead of reusing old ones please 🙏

[Sim4n6]

sorry about that, righ away ...