Repository navigation
FIX Detect URL-encoded null bytes after the target in PathTraversalOutputScorer - #3943
Open
Shivam Sharma (ShivamSharma43) wants to merge 2 commits into
Open
Shivam Sharma (ShivamSharma43) wants to merge 2 commits into
Shivam Sharma (ShivamSharma43) wants to merge 2 commits into
Conversation
…tputScorer The end-of-name check rejected every percent escape after the sensitive file name, so ../../../etc/passwd%00.png and its double-encoded form scored False while the same payload with a literal NUL scored True. An encoded NUL is not a file suffix: it ends the name once a C-string file API decodes it. Other escapes such as %41 and %2541 are still rejected. Fixes microsoft#3942 Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
This branch has not been deployed
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Description
Fixes #3942.
PathTraversalOutputScorerscored../../../etc/passwd%00.pngasFalse, but scored the same payload with a literal NUL (passwd\x00.png) asTrue. The end-of-name lookahead_FILE_ENDrejected every percent escape after the sensitive file name (%(?:25)?[0-9a-f]{2}). That check is there so that.env%41(decodes to.envA) is not taken for.env. It also caught%00and%2500, which decode to a NUL. A NUL is not part of the name: a file API that reads the path as a C string stops there and opens/etc/passwd.The fix leaves the encoded NUL out of the rejected escapes:
%(?!(?:25)?00)(?:25)?[0-9a-f]{2}.%41,%2541,%2eand%252eafter the name are still rejected, so the existing.envAand.env.examplenegatives are unchanged. The class docstring now says that a null byte after the target, literal or encoded, is accepted.Tests and Documentation
New cases in
test_path_traversal_detected(tests/unit/score/regex/test_path_traversal_output_scorer.py):../../../etc/passwd%00and../../../etc/passwd%00.png..%2f..%2fetc%2fpasswd%00.png(fully encoded)../../../etc/passwd%2500.jpg(double-encoded)../../.env%00.txt../../../etc/passwd\x00.png(literal NUL, already detected onmain; kept as a control)The five encoded cases fail on
main(699931d) and pass with the fix. All oftests/unit/score/regexpasses (1954 tests).ruff check,ruff format --checkandty checkare clean on the changed files.No documentation changes beyond the docstring. I didn't run JupyText because no notebooks are affected.
This change was prepared with the help of Claude Code (an AI coding assistant). I reviewed the change and the tests.
🤖 Generated with Claude Code