fix(iast): avoid native taint lookup without an active request context

is_pyobject_tainted and the raw get_ranges wrapper forwarded to the
native no-context multi-slot resolver, whose first step is is_text(obj).
Invoked from a GC/finalizer with no active request, that dereferences a
type already freed by the cyclic GC and crashes (SIGSEGV). Both wrappers
now short-circuit in Python when no IAST request context is active,
mirroring get_tainted_ranges.

Author: KowalskiThomas

ddtrace/appsec/_iast/_taint_tracking/__init__.py

@@ -59,6 +59,16 @@ def get_ranges(string_input: Any, context_id: Optional[int] = None) -> Any:
 
             _CACHE_GET_IAST_CONTEXT_ID = _get_iast_context_id
         context_id = _CACHE_GET_IAST_CONTEXT_ID()
+    if context_id is None:
+        # No active request context. Taint is request-scoped, so there is nothing
+        # to resolve. Short-circuit here instead of falling through to the native
+        # multi-slot resolver: with a null context id ``api_get_ranges`` scans via
+        # ``get_tainted_object_map(obj)`` whose first step, ``is_text(obj)``,
+        # dereferences the object's type. Reached from a finalizer/GC callback on
+        # an object whose type has already been freed, that faults with SIGSEGV.
+        # The sibling wrappers ``is_pyobject_tainted`` and ``get_tainted_ranges``
+        # apply the same request-scoped guard.
+        return []
     return _native_get_ranges(string_input, context_id)
 
 

ddtrace/appsec/_iast/_taint_tracking/_taint_objects_base.py

@@ -77,6 +77,8 @@ def get_tainted_ranges(pyobject: Any) -> tuple:
 
 
 def is_pyobject_tainted(pyobject: Any) -> bool:
+    if not is_iast_request_enabled():
+        return False
     if not isinstance(pyobject, IAST.TAINTEABLE_TYPES):
         return False
 

releasenotes/notes/iast-fix-crash-taint-query-without-context-b3d9f1c47a2e08d6.yaml

@@ -0,0 +1,9 @@
+---
+fixes:
+  - |
+    Code Security (IAST): This fix resolves a crash (``SIGSEGV``) that could
+    occur when a taint-tracking query ran while no IAST request context was
+    active, for example from an object finalizer executed by the garbage
+    collector during interpreter teardown. Such queries now short-circuit in
+    Python instead of scanning the native taint maps, which could dereference
+    the type of an object already freed by the cyclic garbage collector.

tests/appsec/iast/taint_tracking/test_context.py

@@ -108,23 +108,43 @@ def test_get_tainted_ranges_returns_empty_without_context():
     assert get_tainted_ranges("xyz") == tuple()
 
 
-def test_in_taint_map_scans_container_across_active_maps():
+def test_is_pyobject_tainted_is_scoped_to_active_slot():
+    """Taint queries resolve only within the active request slot.
+
+    Two independent slots each hold their own tainted object. Each object is
+    reported tainted only while its owning slot is the active ``IAST_CONTEXT``.
+    With no active request the query short-circuits to ``False`` instead of
+    scanning every slot in native code -- that no-context scan runs
+    ``is_text(obj)`` on the argument and can fault on a type freed during
+    GC/finalization (see the regression tests below).
+    """
     clear_all_request_context_slots()
     _end_iast_context_and_oce()
 
-    # Start two independent maps
     ctx1 = start_request_context()
     ctx2 = start_request_context()
     assert ctx1 is not None and ctx2 is not None and ctx1 != ctx2
 
-    target = "TAINT_ME"
-    # Taint the string into ctx1 explicitly without setting ContextVar
-    target_tainted1 = _taint_pyobject_base(target, "p", target, OriginType.PARAMETER, contextid=ctx1)
-    target_tainted2 = _taint_pyobject_base(target, "p", target, OriginType.PARAMETER, contextid=ctx2)
+    # Distinct values -> distinct objects, so each lives in exactly one slot.
+    tainted_in_1 = _taint_pyobject_base("TAINT_ONE", "p", "TAINT_ONE", OriginType.PARAMETER, contextid=ctx1)
+    tainted_in_2 = _taint_pyobject_base("TAINT_TWO", "p", "TAINT_TWO", OriginType.PARAMETER, contextid=ctx2)
 
-    assert is_pyobject_tainted(target) is False
-    assert is_pyobject_tainted(target_tainted1) is True
-    assert is_pyobject_tainted(target_tainted2) is True
+    IAST_CONTEXT.set(ctx1)
+    assert is_pyobject_tainted(tainted_in_1) is True
+    assert is_pyobject_tainted(tainted_in_2) is False
+
+    IAST_CONTEXT.set(ctx2)
+    assert is_pyobject_tainted(tainted_in_2) is True
+    assert is_pyobject_tainted(tainted_in_1) is False
+
+    # No active request => queries short-circuit to False (native is not consulted).
+    IAST_CONTEXT.set(None)
+    assert is_pyobject_tainted(tainted_in_1) is False
+    assert is_pyobject_tainted(tainted_in_2) is False
+
+    finish_request_context(ctx1)
+    finish_request_context(ctx2)
+    IAST_CONTEXT.set(None)
 
 
 def test_num_objects_tainted_is_per_current_context():
@@ -229,3 +249,92 @@ def test_get_ranges_public_api_does_not_leak_across_request_slots():
     finish_request_context(ctx_a)
     finish_request_context(ctx_b)
     IAST_CONTEXT.set(None)
+
+
+def test_is_pyobject_tainted_without_context_does_not_consult_native():
+    """Regression for a teardown/GC crash (SIGSEGV in ``is_text``).
+
+    With no active request context the query must return ``False`` *without*
+    entering native code. Previously ``is_pyobject_tainted`` forwarded to the
+    native ``is_in_taint_map`` which, with a ``None`` context id, ran the
+    multi-slot resolver whose first step is ``is_text(obj)``. Invoked from a
+    uvloop async-generator/task finalizer during shutdown, that dereferenced the
+    type of an object already freed by the cyclic GC and crashed the process.
+    """
+    clear_all_request_context_slots()
+    _end_iast_context_and_oce()
+
+    ctx = start_request_context()
+    assert ctx is not None
+    tainted = _taint_pyobject_base(
+        "http://dummy.location.com",
+        "location",
+        "http://dummy.location.com",
+        OriginType.PARAMETER,
+        contextid=ctx,
+    )
+    IAST_CONTEXT.set(ctx)
+    assert is_pyobject_tainted(tainted) is True  # sanity: visible within its own slot
+
+    # Detach the context, as happens once the request finishes but the tainted
+    # object is still referenced by a soon-to-be-finalized structure.
+    IAST_CONTEXT.set(None)
+    assert is_pyobject_tainted(tainted) is False
+    assert get_tainted_ranges(tainted) == tuple()
+
+    finish_request_context(ctx)
+    IAST_CONTEXT.set(None)
+
+
+def test_taint_query_from_finalizer_without_context_is_safe():
+    """A ``__del__`` that queries taint outside any request must not crash.
+
+    This mirrors the production stack: a finalizer runs under the GC while no
+    IAST request context is active. The query must resolve to ``False`` in
+    Python without touching the native taint map.
+    """
+    import gc
+
+    clear_all_request_context_slots()
+    _end_iast_context_and_oce()
+    IAST_CONTEXT.set(None)
+
+    results = []
+
+    class _QueriesTaintOnDel:
+        def __init__(self, value):
+            self.value = value
+
+        def __del__(self):
+            results.append(is_pyobject_tainted(self.value))
+
+    obj = _QueriesTaintOnDel("some-tainted-looking-string")
+    del obj
+    gc.collect()
+
+    assert results == [False]
+
+
+def test_get_ranges_public_api_returns_empty_without_context():
+    """The raw public ``get_ranges`` (used by aspects/sinks) also short-circuits.
+
+    With no active request the wrapper must return empty rather than running the
+    native no-context resolver, which is the same ``is_text``-on-a-freed-type
+    crash path guarded above.
+    """
+    from ddtrace.appsec._iast._taint_tracking import get_ranges
+
+    clear_all_request_context_slots()
+    _end_iast_context_and_oce()
+
+    ctx = start_request_context()
+    assert ctx is not None
+    tainted = _taint_pyobject_base("secret", "p", "secret", OriginType.PARAMETER, contextid=ctx)
+
+    # The tainted object lives in a real slot, but with no active context the
+    # public wrapper must not consult the native multi-slot resolver.
+    IAST_CONTEXT.set(None)
+    assert list(get_ranges(tainted)) == []
+
+    finish_request_context(ctx)
+    IAST_CONTEXT.set(None)