Summary
dataclasses-avroschema can place schema-controlled Avro enum symbols into generated Python enum member declarations without confirming that they are valid identifiers. When generator classes process crafted symbols, newline or punctuation characters may alter the generated class body, potentially enabling constrained code injection, namespace modification, or module-load failure.
dataclasses-avroschema can place schema-controlled Avro enum symbols into generated Python enum member declarations without confirming that they are valid identifiers. When generator classes process crafted symbols, newline or punctuation characters may alter the generated class body, potentially enabling constrained code injection, namespace modification, or module-load failure.
Affected context
The vulnerability occurs when dataclasses-avroschema generates Python code from Avro schemas and uses enum symbols as member names after case conversion. It is most relevant when applications invoke the generator classes directly and permit schemas or enum definitions to come from untrusted, externally modified, or insufficiently validated sources.
The vulnerability occurs when dataclasses-avroschema generates Python code from Avro schemas and uses enum symbols as member names after case conversion. It is most relevant when applications invoke the generator classes directly and permit schemas or enum definitions to come from untrusted, externally modified, or insufficiently validated sources.
Exploit preconditions
- Attack surface: Python source-code generation for Avro enums
- Required access: Ability to supply or influence an Avro schema containing enum symbols
- Trigger point: Rendering an enum through the generator's parsing and symbol-rendering logic
- Why exploitation is possible: Enum symbols are inserted into generated class syntax without sufficient identifier validation, allowing syntax-significant characters to affect the generated module
- Attack surface: Python source-code generation for Avro enums
- Required access: Ability to supply or influence an Avro schema containing enum symbols
- Trigger point: Rendering an enum through the generator's parsing and symbol-rendering logic
- Why exploitation is possible: Enum symbols are inserted into generated class syntax without sufficient identifier validation, allowing syntax-significant characters to affect the generated module
Why this happens
The underlying bug is improper neutralization of schema-controlled names during source-code generation. Enum symbols are transformed for naming but are not consistently checked against the target language's identifier rules before being emitted into a Python class body. This maps to CWE-94: Improper Control of Generation of Code, because data intended to represent an enum member can influence generated program structure.
The underlying bug is improper neutralization of schema-controlled names during source-code generation. Enum symbols are transformed for naming but are not consistently checked against the target language's identifier rules before being emitted into a Python class body. This maps to CWE-94: Improper Control of Generation of Code, because data intended to represent an enum member can influence generated program structure.
Potential impact
- Generated modules may fail to load
- An attacker-controlled schema could alter generated namespace contents
- Code execution may be possible if injected statements are accepted and the generated module is subsequently executed
- Build, deployment, or code-generation workflows could be disrupted
- Downstream applications may consume tampered generated source
- Generated modules may fail to load
- An attacker-controlled schema could alter generated namespace contents
- Code execution may be possible if injected statements are accepted and the generated module is subsequently executed
- Build, deployment, or code-generation workflows could be disrupted
- Downstream applications may consume tampered generated source
General mitigation guidance
Mitigation generally focuses on treating schema names as untrusted data during code generation.
Common defensive patterns include:
- Validate every enum symbol against the target language's identifier grammar before rendering
- Reject or safely transform invalid names using a deterministic, collision-resistant naming policy
- Prefer structured code-generation APIs or templates that separate data from executable syntax
- Apply strict schema validation before generation and restrict schemas to trusted sources
- Avoid executing generated code in highly privileged environments
- Run generation and subsequent imports with least privilege and appropriate filesystem isolation
Mitigation generally focuses on treating schema names as untrusted data during code generation.
Common defensive patterns include:
- Validate every enum symbol against the target language's identifier grammar before rendering
- Reject or safely transform invalid names using a deterministic, collision-resistant naming policy
- Prefer structured code-generation APIs or templates that separate data from executable syntax
- Apply strict schema validation before generation and restrict schemas to trusted sources
- Avoid executing generated code in highly privileged environments
- Run generation and subsequent imports with least privilege and appropriate filesystem isolation
How teams detect issues like this
Organizations can look for:
- Static-analysis findings where schema-controlled strings are concatenated or interpolated into source code
- Code-review signals involving enum-name conversion without identifier validation
- Tests using punctuation, whitespace, newline, and reserved-word enum symbols
- CI policies requiring generated identifiers to match an allowlisted language grammar
- Runtime monitoring for unexpected generated files, import failures, or changes to generated module namespaces
Automated security review tools may help identify data-to-code generation paths, but generated output should also be tested directly.
Organizations can look for:
- Static-analysis findings where schema-controlled strings are concatenated or interpolated into source code
- Code-review signals involving enum-name conversion without identifier validation
- Tests using punctuation, whitespace, newline, and reserved-word enum symbols
- CI policies requiring generated identifiers to match an allowlisted language grammar
- Runtime monitoring for unexpected generated files, import failures, or changes to generated module namespaces
Automated security review tools may help identify data-to-code generation paths, but generated output should also be tested directly.
