🛡️ Sentinel: [security improvement]

.jules/sentinel.md

@@ -7,3 +7,8 @@
 **Vulnerability:** The static analyzer was missing `yaml.unsafe_load` and `yaml.full_load` in its `_SERIALISATION_SINKS` mapping, potentially leading to false negatives when tracking untrusted data flowing into these dangerous deserialization functions.
 **Learning:** Even if functions are listed in rule specifications (like `_SINK_SPECS`), they also need to be properly categorized in the core taint propagation logic (`_SERIALISATION_SINKS`) to ensure the analyzer correctly sheds validation provenance (converting output to `UNKNOWN_RAW`).
 **Prevention:** When adding new sinks to rule definitions, always verify if they need to be added to core propagation mappings like `_SERIALISATION_SINKS` or `_PROPAGATING_BUILTINS`.
+
+## 2025-10-09 - [Add Missing Deserialization Sinks to Core Taint Propagation]
+**Vulnerability:** The static analyzer was missing `shelve.open`, `dill.load`, `dill.loads`, `jsonpickle.decode`, `joblib.load`, `torch.load`, and `numpy.load` in its `_SERIALISATION_SINKS` mapping, potentially leading to false negatives when tracking untrusted data flowing into these dangerous deserialization functions.
+**Learning:** Even if functions are listed in rule specifications (like `_SINK_SPECS` in `untrusted_to_deserialization.py`), they also need to be properly categorized in the core taint propagation logic (`_SERIALISATION_SINKS`) to ensure the analyzer correctly sheds validation provenance (converting output to `UNKNOWN_RAW`).
+**Prevention:** When adding new sinks to rule definitions, always verify if they need to be added to core propagation mappings like `_SERIALISATION_SINKS` or `_PROPAGATING_BUILTINS`.

src/wardline/scanner/rules/untrusted_to_deserialization.py

@@ -127,8 +127,9 @@ def _has_literal_true_kw(call: ast.Call, name: str) -> bool:
         "@trusted(level='ASSURED')\ndef f(p):\n    blob = validate(read_raw(p))\n"
         "    obj = pickle.loads(blob)\n    return blob",
         # numpy.load without allow_pickle=True is safe by default (no object unpickling).
+        "import numpy\n"
         "@external_boundary\ndef read_raw(p):\n    return p\n"
-        "@trusted(level='ASSURED')\ndef f(p):\n    return numpy.load(read_raw(p))",
+        "@trusted(level='ASSURED')\ndef f(p):\n    numpy.load(read_raw(p))",
     ),
 )
 

src/wardline/scanner/taint/variable_level.py

@@ -67,6 +67,13 @@
         "tomllib.load",
         "tomli_w.dumps",
         "tomli_w.dump",
+        "shelve.open",
+        "dill.load",
+        "dill.loads",
+        "jsonpickle.decode",
+        "joblib.load",
+        "torch.load",
+        "numpy.load",
     }
 )