🛡️ Sentinel: [CRITICAL] Add third-party deserialization sinks to taint tracking

[tachyon-beep]

🚨 Severity: CRITICAL
💡 Vulnerability: The static analyzer is missing third-party deserialization sinks (dill.load, dill.loads, jsonpickle.decode, joblib.load, torch.load, shelve.open) in the _SERIALISATION_SINKS mapping.
🎯 Impact: This omission leads to false negatives where untrusted data flowing into these dangerous deserialization functions is not properly tracked, potentially allowing remote code execution (RCE) vulnerabilities to go undetected.
🔧 Fix: Added unconditionally unsafe third-party deserialization functions to the core taint propagation mapping _SERIALISATION_SINKS to ensure the analyzer correctly sheds validation provenance (converting output to UNKNOWN_RAW).
✅ Verification: Run make test to ensure all tests pass and verify the correct behavior of the taint tracker.

---

PR created automatically by Jules for task 11054881081097230502 started by @tachyon-beep

[google-labs-jules]

👋 Jules, reporting for duty! I'm here to lend a hand with this pull request.

When you start a review, I'll add a 👀 emoji to each comment to let you know I've read it. I'll focus on feedback directed at me and will do my best to stay out of conversations between you and other bots or reviewers to keep the noise down.

I'll push a commit with your requested changes shortly after. Please note there might be a delay between these steps, but rest assured I'm on the job!

For more direct control, you can switch me to Reactive Mode. When this mode is on, I will only act on comments where you specifically mention me with @jules. You can find this option in the Pull Request section of your global Jules UI settings. You can always switch back!

New to Jules? Learn more at jules.google/docs.

---

For security, I will only act on instructions from the user who triggered this task.

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 6b9e2249de

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[chatgpt-codex-connector]

Preserve typed dispatch for sink-like receiver names

When a typed local or parameter is named torch, this entry makes torch.load() return UNKNOWN_RAW before _resolve_call reaches its _CURRENT_VAR_TYPES dispatch. For example, def f(torch: mymod.Loader): x = torch.load() is now classified raw even when mymod.Loader.load has an ASSURED project summary; the same collision applies to the other newly added module spellings and can create false-positive downstream sink findings. Apply this override only when the receiver resolves to the corresponding imported module, or allow typed-receiver summaries to take precedence.

Useful? React with 👍 / 👎.

[Copilot]

Pull request overview

This PR updates Wardline’s taint propagation model to treat additional (third-party) serialization/deserialization APIs as representation-boundary sinks, ensuring their outputs are conservatively modeled as UNKNOWN_RAW to reduce false negatives in RCE-prone deserialization flows.

Changes:

• Added third-party deserialization-related call FQNs (e.g. dill.*, jsonpickle.decode, joblib.load, torch.load, shelve.open) to _SERIALISATION_SINKS.

Suppressed comments (1)

src/wardline/scanner/taint/variable_level.py:75

• The sink set currently includes only the top-level re-exports torch.load and joblib.load. Calls through common submodule imports (e.g. import torch.serialization as ser; ser.load(...) or from joblib.numpy_pickle import load) will resolve to torch.serialization.load / joblib.numpy_pickle.load and will still bypass the sink check, leaving false negatives for the cases this PR is aiming to close.

        "jsonpickle.decode",
        "joblib.load",
        "torch.load",

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.