BUG-HUNT: [security] Configuration security scanner can be bypassed by YAML tags #3726

New issue

Open

opened 2026-04-05 22:19:39 +00:00 by freemo · 0 comments

freemo commented

2026-04-05 22:19:39 +00:00

Owner

Metadata

Branch: fix/security-scanner-yaml-tag-bypass
Commit Message: fix(config): detect YAML object/apply deserialization tags in security scanner to prevent bypass
Milestone: (none — backlog)
Parent Epic: #362

Background

The security scanner in src/cleveragents/config/security_scanner.py performs line-by-line text matching against a list of disallowed string tokens (e.g., eval(, exec(, __import__). This approach is not context-aware of the file format being scanned.

A YAML file can contain tags that instruct the parser to execute code or deserialize arbitrary Python objects — for example, !!python/object/apply:builtins.eval. The current scanner does not detect these tags because it only looks for the literal string eval(. This allows a malicious configuration file to bypass the scan and achieve arbitrary code execution if yaml.unsafe_load or a similar insecure method is used downstream.

Note: This issue is closely related to #3646 ("Config security scanner does not scan for YAML-specific injection patterns"), which covers !!python/object and !!python/exec. This issue specifically focuses on the !!python/object/apply deserialization vector and the general bypass mechanism via YAML tags, and may be resolved as part of #3646 or treated as a complementary fix.

Location

File: src/cleveragents/config/security_scanner.py
Function/Class: scan_content
Lines: 161–197

Evidence

The scanner's logic is based on entry.pattern.search(effective), which is a simple regex search on each line:

def scan_content(
    content: str,
    file_path: str = "<string>",
) -> list[Violation]:
    # ...
    for line_number, line in enumerate(content.splitlines(), start=1):
        # ...
        effective = _strip_inline_comment(line)
        for entry in _DISALLOWED:
            if entry.pattern.search(effective):
                # ... report violation

A malicious YAML file that bypasses this check:

# This file will pass the security scan, but is malicious.
exploit: !!python/object/apply:builtins.eval
  - "__import__('os').system('echo VULNERABLE')"

The scanner will not find the tokens eval( or __import__ and will report the file as safe.

Expected Behavior

The security scanner should detect and block configuration files that use format-specific mechanisms for code execution, such as YAML's !!python/object/apply tag. The scanner should flag these at CRITICAL severity.

Actual Behavior

The scanner only performs simple text-based matching and can be trivially bypassed, providing a false sense of security. It fails to detect code execution directives embedded in YAML tags.

Subtasks

Write failing Behave scenarios (TDD) for the !!python/object/apply bypass vector
Add !!python/object/apply pattern at CRITICAL severity to _DISALLOWED in security_scanner.py
Add !!python/object/new pattern at CRITICAL severity to _DISALLOWED
Verify the fix covers the general !!python/object/apply:builtins.* family of tags
Ensure validate_config_safety() raises ConfigurationError for all new patterns
Add/update type annotations and ensure nox -e typecheck passes
Confirm nox -e coverage_report shows coverage ≥ 97%

Definition of Done

security_scanner.py detects !!python/object/apply and !!python/object/new tags at CRITICAL severity
validate_config_safety() raises ConfigurationError for all new patterns
Behave unit tests cover the new bypass vector (minimum one scenario per pattern)
No regression in existing scanner tests
All nox stages pass
Coverage >= 97%

Backlog note: This issue was discovered during autonomous operation
on milestone v3.6.0. It does not block milestone completion and has been
placed in the backlog for human review and future milestone assignment.
See also related issue #3646 which may already cover this fix.

Automated by CleverAgents Bot
Supervisor: Bug Hunting | Agent: ca-new-issue-creator

## Metadata - **Branch**: `fix/security-scanner-yaml-tag-bypass` - **Commit Message**: `fix(config): detect YAML object/apply deserialization tags in security scanner to prevent bypass` - **Milestone**: *(none — backlog)* - **Parent Epic**: #362 ## Background The security scanner in `src/cleveragents/config/security_scanner.py` performs line-by-line text matching against a list of disallowed string tokens (e.g., `eval(`, `exec(`, `__import__`). This approach is not context-aware of the file format being scanned. A YAML file can contain tags that instruct the parser to execute code or deserialize arbitrary Python objects — for example, `!!python/object/apply:builtins.eval`. The current scanner does not detect these tags because it only looks for the literal string `eval(`. This allows a malicious configuration file to bypass the scan and achieve arbitrary code execution if `yaml.unsafe_load` or a similar insecure method is used downstream. > **Note:** This issue is closely related to #3646 ("Config security scanner does not scan for YAML-specific injection patterns"), which covers `!!python/object` and `!!python/exec`. This issue specifically focuses on the `!!python/object/apply` deserialization vector and the general bypass mechanism via YAML tags, and may be resolved as part of #3646 or treated as a complementary fix. ### Location - **File**: `src/cleveragents/config/security_scanner.py` - **Function/Class**: `scan_content` - **Lines**: 161–197 ### Evidence The scanner's logic is based on `entry.pattern.search(effective)`, which is a simple regex search on each line: ```python def scan_content( content: str, file_path: str = "<string>", ) -> list[Violation]: # ... for line_number, line in enumerate(content.splitlines(), start=1): # ... effective = _strip_inline_comment(line) for entry in _DISALLOWED: if entry.pattern.search(effective): # ... report violation ``` A malicious YAML file that bypasses this check: ```yaml # This file will pass the security scan, but is malicious. exploit: !!python/object/apply:builtins.eval - "__import__('os').system('echo VULNERABLE')" ``` The scanner will not find the tokens `eval(` or `__import__` and will report the file as safe. ### Expected Behavior The security scanner should detect and block configuration files that use format-specific mechanisms for code execution, such as YAML's `!!python/object/apply` tag. The scanner should flag these at `CRITICAL` severity. ### Actual Behavior The scanner only performs simple text-based matching and can be trivially bypassed, providing a false sense of security. It fails to detect code execution directives embedded in YAML tags. ## Subtasks - [ ] Write failing Behave scenarios (TDD) for the `!!python/object/apply` bypass vector - [ ] Add `!!python/object/apply` pattern at `CRITICAL` severity to `_DISALLOWED` in `security_scanner.py` - [ ] Add `!!python/object/new` pattern at `CRITICAL` severity to `_DISALLOWED` - [ ] Verify the fix covers the general `!!python/object/apply:builtins.*` family of tags - [ ] Ensure `validate_config_safety()` raises `ConfigurationError` for all new patterns - [ ] Add/update type annotations and ensure `nox -e typecheck` passes - [ ] Confirm `nox -e coverage_report` shows coverage ≥ 97% ## Definition of Done - [ ] `security_scanner.py` detects `!!python/object/apply` and `!!python/object/new` tags at `CRITICAL` severity - [ ] `validate_config_safety()` raises `ConfigurationError` for all new patterns - [ ] Behave unit tests cover the new bypass vector (minimum one scenario per pattern) - [ ] No regression in existing scanner tests - [ ] All nox stages pass - [ ] Coverage >= 97% > **Backlog note:** This issue was discovered during autonomous operation > on milestone v3.6.0. It does not block milestone completion and has been > placed in the backlog for human review and future milestone assignment. > See also related issue #3646 which may already cover this fix. --- **Automated by CleverAgents Bot** Supervisor: Bug Hunting | Agent: ca-new-issue-creator

freemo added a new dependency

2026-04-05 22:19:56 +00:00

#362 Epic: Security & Safety Hardening

freemo referenced this issue

2026-04-05 22:22:42 +00:00

[Automated] CleverAgents Build Session - 2026-04-05 (Resumed) #3654

freemo referenced this issue

2026-04-06 07:57:40 +00:00

[Automated] CleverAgents Build Session - 2026-04-06 #3775