fix(iast): guard taint queries without a context#18996
Open
KowalskiThomas wants to merge 1 commit into
Open
Conversation
This comment was marked as outdated.
This comment was marked as outdated.
This comment was marked as outdated.
This comment was marked as outdated.
Codeowners resolved as |
KowalskiThomas
force-pushed
the
dd/kowalski/iast-fix-crash-taint-query-no-context
branch
2 times, most recently
from
87b751c to
2f8ccea
Compare
Circular import analysis
|
KowalskiThomas
force-pushed
the
dd/kowalski/iast-fix-crash-taint-query-no-context
branch
2 times, most recently
from
c6f337a to
0bff86b
Compare
KowalskiThomas
added
AI Generated
Contributor
|
is_pyobject_tainted and the raw get_ranges wrapper forwarded to the native no-context multi-slot resolver, whose first step is is_text(obj). Invoked from a GC/finalizer with no active request, that dereferences a type already freed by the cyclic GC and crashes (SIGSEGV). Both wrappers now short-circuit in Python when no IAST request context is active, mirroring get_tainted_ranges.
KowalskiThomas
force-pushed
the
dd/kowalski/iast-fix-crash-taint-query-no-context
branch
from
0bff86b to
a7f70f6
Compare
BenchmarksBenchmark execution time: 2026-07-12 07:54:54 Comparing candidate commit a7f70f6 in PR branch Found 9 performance improvements and 8 performance regressions! Performance is the same for 67 metrics, 0 unstable metrics. scenario:iast_aspects-re_expand_aspect
scenario:iast_aspects-re_finditer_noaspect
scenario:iast_aspects-re_fullmatch_aspect
scenario:iast_aspects-re_fullmatch_noaspect
scenario:iast_aspects-re_group_aspect
scenario:iast_aspects-re_group_noaspect
scenario:iast_aspects-re_groups_aspect
scenario:iast_aspects-re_groups_noaspect
scenario:iast_aspects-re_match_aspect
scenario:iast_aspects-re_match_noaspect
scenario:iast_aspects-re_search_aspect
scenario:iast_aspects-re_search_noaspect
scenario:iast_aspects-re_sub_aspect
scenario:iast_aspects-re_sub_noaspect
scenario:iast_aspects-re_subn_aspect
scenario:iast_aspects-re_subn_noaspect
scenario:iastaspectsospath-ospathbasename_aspect
|
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Description
This fixes a recurring crash where IAST dereferences a Python type object that has already been freed by the cyclic GC.
Root cause (as identified by LLM):
is_pyobject_taintedis forwarded to the nativeis_in_taint_map(obj, context_id)context_idisNone, so the native binding takes the multi-slot fallbackget_tainted_object_map(obj), whose very first step isis_text(obj)is_textvalidates the object pointer (non-null, aligned, non-nullob_type) but cannot detect a freed typePyUnicode_Check→PyObject_TypeCheck→PyType_IsSubtypethen walks the dangling type and faults.This happens when the query is invoked from an object finalizer / async-generator teardown run by the GC (
uvloop'srun_until_completeis in the reported stack), i.e. mid-lifecycle rather than at interpreter exit, so the existingshutting_downguard (added in #18534, only set from theatexithandler) does not cover it.No other code seems to be affected by this specific issue.
Changes
is_pyobject_taintednow early-returnsFalsewhenis_iast_request_enabled()is false, matchingget_tainted_ranges.get_rangespublic wrapper (_taint_tracking/__init__.py): short-circuit to[]when the resolvedcontext_idisNone, so no-request callers can't reach the sameis_text-on-a-freed-type native path.__del__/GC finalizer querying taint with no active context is safe and returnsFalse; rawget_rangesreturns empty without a context.