T05 · Unauthorized Access and Privilege Escalation
Error
- Location
scripts/repo_reader.py:431- Finding
Repository Symlink Escape Allows Reading Files Outside the Cloned Worktree
- Content
View full analysis
= max_total_chars: break content = read_text_limited(repo_dir / path, max_chars=max_sample_chars) if not content.strip(): continue samples.append({"path": path, "chars": len(content), "content": content}) total += len(content) return samples ``` ```python # scripts/utils.py:77-84 def read_text_limited(path, max_chars=12000): candidate = Path(path) if not candidate.exists() or not candidate.is_file(): return "" raw = candidate.read_bytes() if b"\x00" in raw[:4096]: return "" return raw.decode("utf-8-sig", errors="replace")[:max_chars] ``` ### Technical Analysis Git repositories can contain symbolic links. After checkout, a repository-controlled path may resolve to a target outside the cloned worktree. The sampler joins a repository-controlled path to `repo_dir`, but it does not resolve the resulting path and verify that the canonical target remains inside `repo_dir`. The calls to `Path.exists()`, `Path.is_file()`, and `Path.read_bytes()` follow symbolic links. An attacker can give the symbolic link a filename or extension selected by `_important_files()` or `_should_sample()`, such as `requirements.txt`, `.env`, or another recognized source filename. The linked host file may then be read and included in `samples[]`. The path filtering performed by `safe_relpath()` only detects textual `..` traversal. It does not protect against filesystem-level symlink traversal. ### Attack Path 1. An attacker controls or contributes to a repository that will be ingested. 2. The attacker commits a symbolic link with a high-priority sampling name, for example: ...[truncated 1336 chars]- Remediation
View remediation
``` This avoids following worktree symlinks. 5. Reject non-regular Git tree entries during sampling. Use `git ls-tree` metadata to distinguish blobs from symbolic links before reading them. 6. Add regression tests covering: - Absolute symlinks - Relative symlinks escaping with `../` - Multi-hop symlink chains - Symlinks using important filenames - Symlinks targeting files inside the repository, according to the chosen policy ]]>