> [!warning] AI-Generated Vulnerability Report > This report was produced using AI-assisted security analysis, adversarially verified but not human-confirmed. This finding was challenged against the codebase and survived; we filter out low-confidence results rather than forwarding raw model output. Technical details, exploitability, and severity may still be wrong. Please validate independently before acting. <details open> <summary><strong>Basic information</strong></summary> **Project name:** Eclipse Semantic Modeling Framework (ESMF) **Project id:** dt.esmf **Repository:** https://github.com/eclipse-esmf/esmf-sdk-py-aspect-model-loader </details> <details> <summary><strong>What are the affected versions?</strong></summary> `git tag --contains 0413d5d` shows the introducing commit is present from **v2.1.2** onward; the current code path in `local_file.py` is present from **v2.1.6** onward. Affected: `>=2.1.2, <=2.2.1` (latest tag) and current `main`. </details> <details open> <summary><strong>Summary</strong></summary> `LocalFileResolver` resolves cross-file model references by extracting the third and fourth colon-separated components of any `urn:samm:…` namespace declared in a parsed Turtle file and passing them, unvalidated, to `os.path.join()` to build a directory to scan. A model file containing `@prefix x: <urn:samm:../../../foo:bar#>` or `@prefix x: <urn:samm:/abs/path:bar#>` causes the loader to glob and parse `*.ttl` files from arbitrary directories outside the intended models root, merging their contents into the returned graph. </details> <details> <summary><strong>Severity</strong></summary> Low </details> <details> <summary><strong>Weakness</strong></summary> CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') </details> <details> <summary><strong>Location</strong></summary> - `core/esmf-aspect-meta-model-python/esmf_aspect_meta_model_python/resolver/local_file.py:60-81` — `_parse_namespace()` returns `namespace_specific_str` and `version` with no character-set validation. - `core/esmf-aspect-meta-model-python/esmf_aspect_meta_model_python/resolver/local_file.py:83-98` — `_get_dirs_for_advanced_loading()` calls `join(base_path, namespace_specific_str, version)` directly. - `core/esmf-aspect-meta-model-python/esmf_aspect_meta_model_python/resolver/local_file.py:100-160` — the resulting path is globbed for `*.ttl` and every match is parsed into `self.graph`. </details> <details> <summary><strong>Origin</strong></summary> The namespace-to-filesystem-path logic was introduced in commit `0413d5d8e992738dd1db10e65ef5599bc60674fc` ("Update process of parcing graph", Hanna Shalamitskaya, 2024-02-09) inside `loader/aspect_loader.py`, implementing the dependency-resolution feature requested in issue \#25. It was refactored into its current location in `resolver/local_file.py` by `bb8bfa8f` (2024-10-22). The path-building behaviour has been unchanged since introduction. </details> <details> <summary><strong>Methodology</strong></summary> I reviewed every module that performs file I/O, subprocess execution, dynamic import, or string-templated queries. `local_file.py` stood out because it derives a filesystem path from data inside the file being parsed. I traced the data flow from `rdflib.Graph.namespace_manager.namespaces()` (populated from `@prefix` lines in the input Turtle) through `_parse_namespace` → `os.path.join` → `Path.glob("*.ttl")` → `graph.parse()`, and found no sanitisation step. I then wrote a reproduction against the real class. </details> <details> <summary><strong>Validation</strong></summary> The script below imports the actual `LocalFileResolver`, builds a sandbox with an attacker-controlled model and an out-of-tree "secret" `.ttl`, and shows that `prepare_aspect_model()` merges the secret into the graph. (`SammCli` and `SammUnitsGraph` are stubbed only because a fresh clone lacks the bundled CLI binary and meta-model TTLs; neither participates in the code path under test.) ```python #!/usr/bin/env python3 import os, sys, tempfile, shutil, types from os.path import join PKG_ROOT = "core/esmf-aspect-meta-model-python" # adjust if running elsewhere sys.path.insert(0, PKG_ROOT) # Stub modules that would otherwise download a CLI binary at import time. class _StubSammCli: def __init__(self,*a,**k): pass def prettyprint(self,*a,**k): return "" m = types.ModuleType("esmf_aspect_meta_model_python.samm_cli"); m.SammCli = _StubSammCli sys.modules["esmf_aspect_meta_model_python.samm_cli"] = m m = types.ModuleType("esmf_aspect_meta_model_python.samm_meta_model") class _S: SAMM_VERSION = "2.2.0" m.SammUnitsGraph = _S sys.modules["esmf_aspect_meta_model_python.samm_meta_model"] = m from esmf_aspect_meta_model_python.resolver.local_file import LocalFileResolver import rdflib root = tempfile.mkdtemp(prefix="poc-") try: model_dir = join(root, "models", "org.example.test", "1.0.0") secret_dir = join(root, "secrets", "1.0.0") os.makedirs(model_dir); os.makedirs(secret_dir) with open(join(secret_dir, "confidential.ttl"), "w") as f: f.write('@prefix samm: <urn:samm:org.eclipse.esmf.samm:meta-model:2.2.0#> .\n' '@prefix ex: <http://example.com/secret#> .\n' 'ex:LeakedSecret ex:value "TOP-SECRET-CREDENTIAL-12345" .\n') evil_ttl = join(model_dir, "Evil.ttl") with open(evil_ttl, "w") as f: # absolute path component → os.path.join discards base_path entirely f.write('@prefix samm: <urn:samm:org.eclipse.esmf.samm:meta-model:2.2.0#> .\n' f'@prefix evil: <urn:samm:{join(root,"secrets")}:1.0.0#> .\n' '<urn:samm:org.example.test:1.0.0#Evil> a samm:Aspect ;\n' ' samm:properties () ; samm:operations () .\n') print("--- _parse_namespace (real code) ---") for ns in ["urn:samm:../secrets:1.0.0#", "urn:samm:/etc:ssl#"]: print(f" {ns!r} -> {LocalFileResolver._parse_namespace(ns)!r}") r = LocalFileResolver() g = r.read(evil_ttl) print(f"\nDirs to scan: {[os.path.realpath(d) for d in r._get_dirs_for_advanced_loading(evil_ttl)]}") print(f" (models root is {os.path.realpath(join(root,'models'))})") r.prepare_aspect_model(g) leaked = list(r.graph.triples((rdflib.URIRef("http://example.com/secret#LeakedSecret"), None, None))) print(f"\n>>> Out-of-tree triples merged into graph: {leaked}") finally: shutil.rmtree(root, ignore_errors=True) ``` Observed output (run against `5f387a9`, Python 3.13, rdflib 7.6.0): ``` --- _parse_namespace (real code) --- 'urn:samm:../secrets:1.0.0#' -> ('../secrets', '1.0.0') 'urn:samm:/etc:ssl#' -> ('/etc', 'ssl') Dirs to scan: ['/tmp/poc-tcwtk1cu/secrets/1.0.0'] (models root is /tmp/poc-tcwtk1cu/models) >>> Out-of-tree triples merged into graph: [(rdflib.term.URIRef('http://example.com/secret#LeakedSecret'), rdflib.term.URIRef('http://example.com/secret#value'), rdflib.term.Literal('TOP-SECRET-CREDENTIAL-12345'))] ``` Mitigations checked and ruled out: there is no character-set check, no `os.path.realpath` / `commonpath` containment check, and no allow-list of namespace identifiers anywhere between the prefix declaration and the `glob` call. Issue \#25 specifies the intended namespace format (`com.mycompany.mynamespace`) but the implementation never enforces it. </details> <details> <summary><strong>Detail</strong></summary> The public flow is `SAMMGraph.parse(file_path)` → `SAMMGraph.load_aspect_model()` → `LocalFileResolver.prepare_aspect_model()` → `_get_dependency_files()`. For the input file and each transitively discovered `.ttl`, the resolver: 1. enumerates all `@prefix` bindings via `self.graph.namespace_manager.namespaces()` (local_file.py:92); 2. for each namespace string of the form `urn:samm:<NSS>:<VER>#` (exactly four `:`-separated parts, first two equal to `urn` and `samm`), extracts `<NSS>` and `<VER>` verbatim (local_file.py:70-79); 3. builds `os.path.join(Path(file_path).parents[2], <NSS>, <VER>)` (local_file.py:96); 4. globs `*.ttl` in that directory (local_file.py:125) and parses each match into the same graph (local_file.py:107). Because `os.path.join` discards everything before an absolute component, `<NSS>` beginning with `/` yields an absolute target. Relative `..` sequences in `<NSS>` or `<VER>` are also honoured. The `<NSS> == "org.eclipse.esmf.samm"` exclusion at line 75 is the only filtering applied. </details> <details> <summary><strong>Other patterns examined and ruled out</strong></summary> | Sink | Location | Why it is not a finding | | --- | --- | --- | | `subprocess.run(call_args, …)` | `samm_cli/base.py:116` | Argument vector (list, no shell). All inputs come from the developer calling `SammCli` methods; per the documented API the developer is the trust boundary for these arguments. Not reachable from parsed file content. | | `importlib.import_module` + `getattr` | `loader/model_element_factory.py:136-139` | `element_type` is taken from the fragment of an `rdf:type` URI in the parsed graph (attacker-influenced), but the import path is hard-prefixed with `esmf_aspect_meta_model_python.loader.instantiator.` and `importlib.import_module` with an absolute name does not honour `..` segments. Worst case is `ModuleNotFoundError`. | | `getattr(self, attr_name, …)` | `impl/base_impl.py:111,133` | `attr_name` iterates the hard-coded `SCALAR_ATTR_NAMES` / `LIST_ATTR_NAMES` lists. Not data-driven. | | `Template("SELECT … {$unit …}").substitute(unit=unit)` | `samm_meta_model.py:27,71` | SPARQL string interpolation, but `unit` is supplied by the developer calling `units.get_info(...)` and the queried graph is the bundled, read-only `units.ttl`. No untrusted source reaches it; impact of injection would be limited to reading the same static unit catalogue. | | `tarfile.open(...).extractall()` / `zipfile.ZipFile(...).extractall()` | `samm_cli/download.py:65-74` | Archive is fetched from a hard-coded `https://github.com/eclipse-esmf/esmf-sdk/releases/...` URL. A malicious archive would be a supply-chain compromise of an upstream Eclipse project, not a flaw in this repository's logic. | | `archive.extract(file, …)` after `file.startswith("samm")` / `file.startswith("valid")` | `scripts/samm/download_samm_release.py:48-51`, `scripts/download_test_models.py:51-54` | Build-time helper scripts that fetch from hard-coded `repo1.maven.org` HTTPS URLs. Same supply-chain rationale; no first-party trust boundary crossed. | | `open(path.join(file_path, file.name), "wb")` with `file.name` from API JSON | `scripts/samm/download_samm_branch.py:61` | Build-time script consuming `api.github.com` over HTTPS. Trust boundary is GitHub. | | `RdfHelper.get_rdf_list_values` recursion / `find_named_parent` recursion | `loader/rdf_helper.py:24-75` | A crafted RDF list could exhaust the Python recursion limit, but this only crashes the calling process; the caller chose to parse this file, so it is a robustness bug rather than a denial-of-service against other users. | --- **Verification verdict:** TRUE POSITIVE ### Verification details The verdict is unchanged; here is the structured documentation completing the remaining phases for this single finding. </details> <details> <summary><strong>Phase 2 addenda (explicit)</strong></summary> - **Mathematical bounds: N/A** — no arithmetic or size relationships are involved; the vulnerable condition is purely string handling. The only structural constraint is that the namespace must split into exactly 4 colon-separated parts (`local_file.py:71`), which the payloads `urn:samm:/abs/path:1.0.0#` and `urn:samm:../secrets:1.0.0#` satisfy (colon-free NSS/VER), as proven by the executed `_parse_namespace` output. - **Race conditions: N/A** — the trigger is a single-threaded, deterministic parse-then-glob sequence; no TOCTOU window is claimed or needed. </details> <details> <summary><strong>Phase 5 — Devil's Advocate (13-item checklist)</strong></summary> 1. **Full validation chain traced:** From `SAMMGraph.parse()` → `InputHandler.get_reader()` → `LocalFileResolver.read()` → `load_aspect_model()` → `prepare_aspect_model()`. No validation of namespace strings exists anywhere on this path; `_validate_samm_namespace_version` (samm_graph.py:165) runs *after* the sink and checks only the meta-model version. 1a. **Conditional reachability:** The only condition gating the sink is `len(namespace_info) == 4` and `urn`/`samm` prefixes (local_file.py:71-74) — trivially satisfied by the payload; the `org.eclipse.esmf.samm` exclusion (line 75) skips only the meta-model namespace, not attacker namespaces. 2. **Defensive patterns:** The `exists()` check at local_file.py:122 is availability-only (raises if dir missing); it does not constrain the path. No containment/realpath check exists. 3. **Exploitable data path confirmed:** Not assumed — executed. The PoC merged out-of-tree triples end-to-end through the real class. 4. **Data source context:** Source is `@prefix` declarations inside the parsed Turtle file — the exact artifact the library exists to consume from third parties per the README ("applications that don't have any a-prior knowledge except for the aspect model file"). Content is attacker-controllable whenever models are exchanged; the file *path* is operator-chosen, which is why exposure is LOCAL-ONLY at the library level. 5. **Bounds validation logic:** N/A (no arithmetic). 6. **TOCTOU:** N/A (not a TOCTOU claim). 7. **API contract:** `os.path.join` documents exactly the exploited behavior (absolute component discards the base); rdflib's `namespace_manager.namespaces()` returns the URN verbatim — confirmed empirically, no normalization defeats the payload. `Path.glob("*.ttl")` follows the traversed directory without containment. 8. **Internal vs external input:** The namespace strings are not internal configuration — they come from the parsed input document itself. 9. **Pattern vs analysis:** Not pattern-matched — the escape was demonstrated with real code, including a negative control (well-formed namespace stayed contained, absent directory raised `NotADirectoryError`). 10. **Concurrency:** N/A. 11. **Real vs theoretical impact:** Real information disclosure: out-of-tree `.ttl` content enters the graph backing the returned `Aspect`, leaking wherever the application reflects model data (validation reports, generated schemas/docs). Bounded to Turtle-parseable files readable by the process — hence Low, not Medium. 12. **Defense-in-depth vs primary control:** There is no primary control being bypassed elsewhere — path construction here *is* the only control point, and it has none. 13. **Checklist applied in full:** All items worked through; the two genuine attacker constraints found (target directory must exist or the load aborts; relative payloads read the file but abort the recursive walk) weaken blind exploitation but do not negate the flaw — absolute payloads against known locations succeed cleanly. </details> <details> <summary><strong>Gate Review</strong></summary> | Gate | Verdict | Evidence | |---|---|---| | 1. Process | **PASS** | Claim restated; data flow traced source→sink with file:line; exploitability, impact, PoC, and devil's advocate documented. | | 2. Reachability | **PASS** | Default public API path (`SAMMGraph.parse(file)` + `load_aspect_model()`); attacker controls the `@prefix` content; PoC confirms control reaches the sink verbatim. | | 3. Real Impact | **PASS** | Information disclosure: out-of-tree `.ttl` triples merged into the returned model graph (demonstrated leak of a planted secret literal). Not merely operational. | | 4. PoC Validation | **PASS** | Executable PoC run against cloned HEAD showed trigger and impact; negative controls behaved as expected. | | 5. Math Bounds | **PASS (N/A)** | No mathematical precondition exists that could prevent the vulnerable condition; the 4-part split constraint is satisfiable. | | 6. Environment | **PASS** | No framework/library normalization intervenes (rdflib returns URNs verbatim); no sandbox or containment in the package. The exists-check limits blind probing but does not eliminate the vulnerability. | **BUG \#1 TRUE POSITIVE** — Unvalidated `urn:samm:<NSS>:<VER>` namespace components from parsed Turtle are joined into a filesystem path and globbed, letting a crafted `@prefix` (absolute path reliably; `../` partially) merge arbitrary out-of-tree `.ttl` files into the returned model graph. CWE-22, Low. **Final summary:** 1 TRUE POSITIVE, 0 FALSE POSITIVES. EXPOSURE: LOCAL-ONLY — the attacker must get their `.ttl` model file loaded by the victim's process; the library exposes no network surface itself (downstream model-exchange services would escalate this). SCOPE: PRODUCTION — PyPI-published SDK library; README: components "to be consumed by developers that aim to build applications or tools dealing with SAMM"; no dev-only/out-of-scope statement, actively maintained, no EOL/deprecation notices. </details> <details> <summary><strong>Steps to reproduce</strong></summary> Attacker supplies an aspect-model file (e.g., to a service or tool that loads partner-supplied SAMM models — the use case the README describes as "applications that don't have any a-prior knowledge except for the aspect model file"). The file declares: **Proof of concept:** [poc.txt](/uploads/dfe3ca59e6f1981265ff408805f5bd44/poc.txt) When the victim calls `samm_graph.parse(path); samm_graph.load_aspect_model()`, every `*.ttl` under `/srv/other-tenant-models/com.victim/1.0.0/` is parsed into the graph that backs the returned `Aspect` object. If the application reflects model metadata back to the submitter (validation reports, generated documentation, JSON schema, etc.), the contents of those files leak. Relative traversal (`urn:samm:../../other-customer:1.0.0#`) works equally for escaping a per-submission sandbox under a shared models root. </details> <details> <summary><strong>Do you know any mitigations of the issue?</strong></summary> Validate `namespace_specific_str` against the SAMM namespace grammar (e.g., `^[A-Za-z][A-Za-z0-9]*(\.[A-Za-z][A-Za-z0-9]*)*$`) and `version` against `^\d+\.\d+\.\d+$` before path construction; alternatively, resolve the joined path with `os.path.realpath` and reject it if it is not a descendant of `Path(file_path).parents[2]`. <!-- l1-helper-dup: e7edb9969eed5fa44a80e8e4ba4f52c24c80590989cf1940e2e392c18fd99c45 --> </details>