UAT: Config security scanner (security_scanner.py) does not scan for YAML-specific injection patterns — !!python/object and !!python/exec constructors not detected #3646

Open
opened 2026-04-05 21:05:02 +00:00 by freemo · 1 comment
Owner

Metadata

  • Branch: fix/security-scanner-yaml-injection-patterns
  • Commit Message: fix(config): add YAML injection and Jinja2 sandbox-escape patterns to security scanner
  • Milestone: (none — backlog)
  • Parent Epic: #362

Background

The config security scanner (src/cleveragents/config/security_scanner.py) scans YAML/TOML config files for dangerous patterns like eval(), exec(), __import__, and subprocess.*. However, it does not detect YAML-specific injection patterns that are dangerous even when using yaml.safe_load — specifically, it does not warn when YAML files contain !!python/object, !!python/exec, !!python/module, or other YAML type tags that would be silently ignored by safe_load but could indicate a malicious or corrupted config file.

More critically, the scanner also does not detect Jinja2 template injection patterns in YAML files that are processed by the YAMLTemplateEngine. The YAMLTemplateEngine uses jinja2.sandbox.SandboxedEnvironment (which is correct), but the scanner does not flag {{ config.__class__.__mro__ }} or similar sandbox-escape attempts in YAML template files.

What Was Tested

  • Code review of src/cleveragents/config/security_scanner.py
  • Reviewed the _DISALLOWED pattern registry — it covers Python code execution primitives but not YAML-specific injection
  • Reviewed src/cleveragents/actor/yaml_template_engine.py — uses SandboxedEnvironment correctly but no pre-scan of template content for suspicious patterns

Expected Behavior (from spec)

The security scanner should detect:

  1. YAML type tags that indicate potential deserialization attacks (!!python/object, !!python/exec, !!python/module, !!python/name)
  2. Jinja2 sandbox escape attempts in template YAML files (__class__, __mro__, __subclasses__, __builtins__)
  3. These should be flagged at HIGH or CRITICAL severity

Actual Behavior

The scanner only checks for Python code execution primitives. A YAML file containing !!python/exec: "os.system('rm -rf /')" would not be flagged by the scanner (though yaml.safe_load would safely ignore the tag, the scanner should still warn about suspicious content).

Code Location

src/cleveragents/config/security_scanner.py, lines 62–85 (the _DISALLOWED pattern registry)

Add the following patterns to _DISALLOWED:

  • !!python/ — CRITICAL: YAML Python object constructor tag
  • !!python/exec — CRITICAL: YAML Python exec tag
  • __class__.__mro__ — HIGH: Jinja2 sandbox escape attempt
  • __subclasses__ — HIGH: Jinja2 sandbox escape attempt
  • __builtins__ — HIGH: Jinja2 sandbox escape attempt

Subtasks

  • Write failing Behave scenarios (TDD) for each new pattern: !!python/, !!python/exec, __class__.__mro__, __subclasses__, __builtins__
  • Add YAML type-tag patterns (!!python/) at CRITICAL severity to _DISALLOWED in security_scanner.py
  • Add Jinja2 sandbox-escape patterns (__class__.__mro__, __subclasses__, __builtins__) at HIGH severity to _DISALLOWED
  • Ensure validate_config_safety() raises ConfigurationError for all new patterns
  • Verify YAMLTemplateEngine calls the scanner (or add a pre-scan call) on all YAML template files before rendering
  • Verify actor/skill YAML loaders call the scanner before loading
  • Add/update type annotations and ensure nox -e typecheck passes
  • Confirm nox -e coverage_report shows coverage ≥ 97%

Definition of Done

  • security_scanner.py detects YAML type tags (!!python/) at CRITICAL severity
  • security_scanner.py detects Jinja2 sandbox escape patterns (__class__.__mro__, __subclasses__, __builtins__) at HIGH severity
  • validate_config_safety() raises ConfigurationError for all new patterns
  • Behave unit tests cover every new pattern (one scenario per pattern minimum)
  • The scanner is invoked on all YAML files loaded by YAMLTemplateEngine and actor/skill loaders
  • All nox stages pass
  • Coverage >= 97%

Backlog note: This issue was discovered during autonomous operation
on milestone v3.3.0. It does not block milestone completion and has been
placed in the backlog for human review and future milestone assignment.


Automated by CleverAgents Bot
Supervisor: UAT Testing | Agent: ca-new-issue-creator

## Metadata - **Branch**: `fix/security-scanner-yaml-injection-patterns` - **Commit Message**: `fix(config): add YAML injection and Jinja2 sandbox-escape patterns to security scanner` - **Milestone**: *(none — backlog)* - **Parent Epic**: #362 ## Background The config security scanner (`src/cleveragents/config/security_scanner.py`) scans YAML/TOML config files for dangerous patterns like `eval()`, `exec()`, `__import__`, and `subprocess.*`. However, it does not detect YAML-specific injection patterns that are dangerous even when using `yaml.safe_load` — specifically, it does not warn when YAML files contain `!!python/object`, `!!python/exec`, `!!python/module`, or other YAML type tags that would be silently ignored by `safe_load` but could indicate a malicious or corrupted config file. More critically, the scanner also does not detect Jinja2 template injection patterns in YAML files that are processed by the `YAMLTemplateEngine`. The `YAMLTemplateEngine` uses `jinja2.sandbox.SandboxedEnvironment` (which is correct), but the scanner does not flag `{{ config.__class__.__mro__ }}` or similar sandbox-escape attempts in YAML template files. ## What Was Tested - Code review of `src/cleveragents/config/security_scanner.py` - Reviewed the `_DISALLOWED` pattern registry — it covers Python code execution primitives but not YAML-specific injection - Reviewed `src/cleveragents/actor/yaml_template_engine.py` — uses `SandboxedEnvironment` correctly but no pre-scan of template content for suspicious patterns ## Expected Behavior (from spec) The security scanner should detect: 1. YAML type tags that indicate potential deserialization attacks (`!!python/object`, `!!python/exec`, `!!python/module`, `!!python/name`) 2. Jinja2 sandbox escape attempts in template YAML files (`__class__`, `__mro__`, `__subclasses__`, `__builtins__`) 3. These should be flagged at `HIGH` or `CRITICAL` severity ## Actual Behavior The scanner only checks for Python code execution primitives. A YAML file containing `!!python/exec: "os.system('rm -rf /')"` would not be flagged by the scanner (though `yaml.safe_load` would safely ignore the tag, the scanner should still warn about suspicious content). ## Code Location `src/cleveragents/config/security_scanner.py`, lines 62–85 (the `_DISALLOWED` pattern registry) ## Recommended Fix Add the following patterns to `_DISALLOWED`: - `!!python/` — CRITICAL: YAML Python object constructor tag - `!!python/exec` — CRITICAL: YAML Python exec tag - `__class__.__mro__` — HIGH: Jinja2 sandbox escape attempt - `__subclasses__` — HIGH: Jinja2 sandbox escape attempt - `__builtins__` — HIGH: Jinja2 sandbox escape attempt ## Subtasks - [ ] Write failing Behave scenarios (TDD) for each new pattern: `!!python/`, `!!python/exec`, `__class__.__mro__`, `__subclasses__`, `__builtins__` - [ ] Add YAML type-tag patterns (`!!python/`) at `CRITICAL` severity to `_DISALLOWED` in `security_scanner.py` - [ ] Add Jinja2 sandbox-escape patterns (`__class__.__mro__`, `__subclasses__`, `__builtins__`) at `HIGH` severity to `_DISALLOWED` - [ ] Ensure `validate_config_safety()` raises `ConfigurationError` for all new patterns - [ ] Verify `YAMLTemplateEngine` calls the scanner (or add a pre-scan call) on all YAML template files before rendering - [ ] Verify actor/skill YAML loaders call the scanner before loading - [ ] Add/update type annotations and ensure `nox -e typecheck` passes - [ ] Confirm `nox -e coverage_report` shows coverage ≥ 97% ## Definition of Done - [ ] `security_scanner.py` detects YAML type tags (`!!python/`) at `CRITICAL` severity - [ ] `security_scanner.py` detects Jinja2 sandbox escape patterns (`__class__.__mro__`, `__subclasses__`, `__builtins__`) at `HIGH` severity - [ ] `validate_config_safety()` raises `ConfigurationError` for all new patterns - [ ] Behave unit tests cover every new pattern (one scenario per pattern minimum) - [ ] The scanner is invoked on all YAML files loaded by `YAMLTemplateEngine` and actor/skill loaders - [ ] All nox stages pass - [ ] Coverage >= 97% > **Backlog note:** This issue was discovered during autonomous operation > on milestone v3.3.0. It does not block milestone completion and has been > placed in the backlog for human review and future milestone assignment. --- **Automated by CleverAgents Bot** Supervisor: UAT Testing | Agent: ca-new-issue-creator
freemo added this to the v3.6.0 milestone 2026-04-05 21:07:10 +00:00
freemo removed this from the v3.6.0 milestone 2026-04-06 21:07:05 +00:00
HAL9000 self-assigned this 2026-04-08 18:51:52 +00:00
HAL9000 added this to the v3.6.0 milestone 2026-04-08 18:51:52 +00:00
Owner

Issue assigned to @HAL9000 and milestone set to v3.6.0.

Milestone Rationale: Security scanner YAML injection pattern detection is a security hardening feature. v3.6.0 covers security improvements.

Assignment Rationale: Default assignment to HAL9000 to maintain velocity.


Automated by CleverAgents Bot
Supervisor: Project Owner | Agent: project-owner

Issue assigned to @HAL9000 and milestone set to **v3.6.0**. **Milestone Rationale**: Security scanner YAML injection pattern detection is a security hardening feature. v3.6.0 covers security improvements. **Assignment Rationale**: Default assignment to HAL9000 to maintain velocity. --- **Automated by CleverAgents Bot** Supervisor: Project Owner | Agent: project-owner
Sign in to join this conversation.
No milestone
No project
No assignees
2 participants
Notifications
Due date
The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Blocks
#362 Epic: Security & Safety Hardening
cleveragents/cleveragents-core
Reference
cleveragents/cleveragents-core#3646
No description provided.