IBM / unitxt / 37196599562

78%

push

github

Security: Fix CodeQL alerts for ReDoS, path injection, and workflow permissions (#1984)

* Security: Fix CodeQL alerts for ReDoS, path injection, workflow permissions

Remediates the 17 open CodeQL code-scanning alerts reported in the IBM OSPO
security notification (#1981).

1. ReDoS in is_camel_case() -- 1x py/redos, HIGH (CWE-1333)

   src/unitxt/text_utils.py: the pattern "^[A-Z]+([a-z0-9]*[A-Z]*[a-z0-9]*)*$"
   has an inner group that matches the empty string with overlapping
   alternatives, so a non-matching input backtracks catastrophically. An
   18-character input did not complete within 20 seconds.

   Reachable from artifact.py:215, which calls is_camel_case() on artifact
   class names.

   Replaced with the equivalent linear-time form "^[A-Z]+[a-zA-Z0-9]*$".
   Equivalence verified against all 538 registered Artifact subclass names and
   an exhaustive fuzz over the relevant character classes: zero disagreements.
   A 50,000-character adversarial input now completes in 0.6ms.

2. Path injection from CLI arguments -- 5x py/path-injection, HIGH (CWE-22)

   src/unitxt/evaluate_cli.py: --output_path and --output_file_prefix flowed
   from argparse into five filesystem sinks without validation (os.makedirs,
   two result-file writes, and os.listdir/open in extract_scores). A prefix
   such as '../../../etc/cron.d/x' escaped the output directory.

   Added two helpers:
   - _normalize_directory(): realpath/expanduser the directory inputs. The
     resolved location is deliberately not confined to the CWD, since writing
     results to an arbitrary directory is the documented purpose of
     --output_path.
   - _validate_filename_component(): reject a prefix containing a path
     separator, or equal to '.'/'..'. This is the actual vulnerability -- a
     filename prefix has no legitimate reason to contain a separator.

   extract_scores() now normalizes its directory and confirms each path built
   from the listing stays inside it before openi... (continued)

2785 of 4018 branches covered (69.31%)

Branch coverage included in aggregate %.

10974 of 13550 relevant lines covered (80.99%)

0.81 hits per line