Skip to content

WS-SEC-01: Checker plugins execute in-process with no isolation #133

Description

@catchmeifyoucaan

Finding

Checkers run as in-process callables registered in \CheckerRegistry\ (\�ackend/app/modules/checkers/runner.py). No subprocess isolation, no execution timeout, no resource limits.

Risk

A misbehaving checker (infinite loop, memory exhaustion, file system access) can DoS or compromise the API worker. A malicious or compromised checker can access the database connection, Redis, and all request data via \CheckerContext.

Location

  • \checkers/runner.py\ — \Checker(Protocol)\ with \�sync def run(self, context)\
  • \CheckerRegistry.register()\ — no sandbox at registration or execution

Recommendation

  1. Add execution timeout to every checker run
  2. Move checker execution to an isolated subprocess or Celery task with resource limits
  3. Audit which checkers access what data and scope their privileges

Severity: High

Metadata

Metadata

Assignees

No one assigned

    Labels

    No labels
    No labels

    Type

    No type

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions