fix(evaluation): Prevent path traversal in local eval managers#5039
Open
shivan4030 wants to merge 3 commits intogoogle:mainfrom
Open
fix(evaluation): Prevent path traversal in local eval managers#5039shivan4030 wants to merge 3 commits intogoogle:mainfrom
shivan4030 wants to merge 3 commits intogoogle:mainfrom
Conversation
Author
|
@mbalandat @siddharthab, could you please review this PR and approve the CI workflows? |
|
Sorry, did you mean to tag me? |
Collaborator
|
Hi @shivan4030 , Thank you for your contribution! We appreciate you taking the time to submit this pull request. Can you please fix the failing mypy-diff tests. Also can you fix the formatting errors. You can use autoformat.sh |
rohityan
added
the
request clarification
This commit adds a strict validation regex (^[a-zA-Z0-9_\-\.]+$) and explicit `..` checks for app_name, eval_set_id, eval_case_id, and eval_set_result_id in LocalEvalSetsManager and LocalEvalSetResultsManager. By sanitizing path parameters, this prevents directory traversal attacks when the FastAPI endpoints attempt to read or modify evaluation JSON files on the local filesystem.
Replaces `hashlib.md5` with `hashlib.sha256` for session key generation in `mcp_session_manager.py` to mitigate security risks associated with weak cryptographic hashes. Updated the corresponding unit test to expect SHA256 hashes.
Author
|
I've updated the PR with the formatting fixes and addressed the mypy issues. Ready for another look! |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
4 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
This commit adds a strict validation regex (^[a-zA-Z0-9_-.]+$) and explicit
..checks for app_name, eval_set_id, eval_case_id, and eval_set_result_id in LocalEvalSetsManager and LocalEvalSetResultsManager. By sanitizing path parameters, this prevents directory traversal attacks when the FastAPI endpoints attempt to read or modify evaluation JSON files on the local filesystem.Problem:
The
LocalEvalSetsManagerandLocalEvalSetResultsManagerclasses insidesrc/google/adk/evaluation/were missing input sanitization for various path routing IDs (app_name,eval_set_id,eval_case_id, andeval_set_result_id). Because these values were blindly passed intoos.path.join()when executing operations viaadk webendpoints (likeGET /apps/{app_name}/eval-sets/{eval_set_id}...), an attacker could craft malicious directory traversal patterns (e.g.,../..) allowing them to traverse out of the target evaluation directory. This introduces a vulnerability where unauthorized users could read or delete sensitive evaluation records (.evalset.json/.evalset_result.jsonfiles) belonging to other applications on the server's filesystem.Solution:
A new
_validate_id()logic enforcement was introduced across the board inLocalEvalSetsManagerandLocalEvalSetResultsManager. This restricts parameters using a rigid regex pattern (^[a-zA-Z0-9_\-\.]+$) that allows necessary characters like hyphens and floating-point timestamps (which are natively appended to result IDs), but explicitly rejects payloads containing double dots (..). This ensures theadk webrouter endpoints can strictly read, update, or delete payloads within their expected hierarchical folder paths, permanently patching the unauthenticated scope leakage risk.