fix: deny null DACL before native ACL accessor

Co-authored-by: Medulla <medulla@tinyhumans.ai>

Author: senamakel

crates/tinysecurity-audit/src/sink_windows_negative_tests.rs

@@ -356,14 +356,14 @@ exit 0
     # localized Win32-message suffix against this bounded numeric vocabulary.
     # Raw exception text stays in memory and ambiguous matches report zero.
     $message = $_.Exception.Message.TrimEnd([char[]]@('.', ' ', [char]13, [char]10))
-    $matches = @()
+    $nativeMatches = @()
     foreach ($candidate in @(2, 3, 5, 8, 14, 87, 193, 233, 267, 740, 1058, 1060, 1314, 1326, 1330, 1385, 1450, 1783)) {
         $suffix = [ComponentModel.Win32Exception]::new($candidate).Message.TrimEnd([char[]]@('.', ' ', [char]13, [char]10))
-        if ($message.EndsWith($suffix, [StringComparison]::Ordinal)) { $matches += $candidate }
+        if ($message.EndsWith($suffix, [StringComparison]::Ordinal)) { $nativeMatches += $candidate }
     }
     $derived = 0
-    if ($matches.Count -eq 1) { $derived = $matches[0] }
-    Write-Output ('audit-account-stage=' + $stage + ' message-derived-code=' + $derived + ' candidates=' + $matches.Count)
+    if ($nativeMatches.Count -eq 1) { $derived = $nativeMatches[0] }
+    Write-Output ('audit-account-stage=' + $stage + ' message-derived-code=' + $derived + ' candidates=' + $nativeMatches.Count)
     $exception = $_.Exception
     for ($depth = 0; ($null -ne $exception) -and ($depth -lt 8); $depth++) {
         $native = 0

crates/tinysecurity-audit/src/windows.rs

@@ -213,12 +213,21 @@ fn valid_name(path: &Path) -> Result<()> {
     Ok(())
 }
 fn descriptor(file: &File) -> Result<LocalBox<SecurityDescriptor>> {
-    wrappers::GetSecurityInfo(
+    let sd = wrappers::GetSecurityInfo(
         file,
         SeObjectType::SE_FILE_OBJECT,
         SecurityInformation::Owner | SecurityInformation::Dacl,
     )
-    .map_err(|_| Error::Permissions)
+    .map_err(|_| Error::Permissions)?;
+    let sddl = sd
+        .as_sddl()
+        .map_err(|_| Error::Permissions)?
+        .into_string()
+        .map_err(|_| Error::Permissions)?;
+    if !crate::windows_acl::has_dacl_entries(&sddl) {
+        return Err(Error::Permissions);
+    }
+    Ok(sd)
 }
 fn sid_text(sid: &Sid) -> Result<String> {
     wrappers::ConvertSidToStringSid(sid)

crates/tinysecurity-audit/src/windows_acl.rs

@@ -22,6 +22,15 @@ pub(crate) fn protected(mut flags: &str) -> bool {
     }
     seen & 1 != 0
 }
+// A present NULL DACL permits everyone, but the safe dependency's native
+// dacl() accessor panics for it. Check the canonical native SDDL first. This
+// does not validate ACE rights: the existing handle checks still do that.
+pub(crate) fn has_dacl_entries(sddl: &str) -> bool {
+    sddl.split("D:")
+        .nth(1)
+        .and_then(|dacl| dacl.split("S:").next())
+        .is_some_and(|dacl| dacl.contains('('))
+}
 #[cfg(test)]
 #[path = "windows_acl_tests.rs"]
 mod tests;

crates/tinysecurity-audit/src/windows_acl_tests.rs

@@ -15,3 +15,24 @@ fn windows_unprotected_unknown_or_duplicate_dacl_control_tokens_are_denied() {
         assert!(!protected(flags), "unacceptable control flags: {flags}");
     }
 }
+
+#[test]
+fn windows_null_absent_and_empty_dacls_are_rejected_before_native_acl_access() {
+    for sddl in [
+        "O:SY",
+        "O:SYD:",
+        "O:SYD:P",
+        "O:SYD:NO_ACCESS_CONTROL",
+        "O:SYD:PNO_ACCESS_CONTROL",
+        "O:SYS:(AU;SA;FA;;;WD)",
+        "O:SYD:PS:(AU;SA;FA;;;WD)",
+    ] {
+        assert!(!has_dacl_entries(sddl));
+    }
+    for sddl in [
+        "O:SYD:P(A;OICI;FA;;;SY)",
+        "O:SYD:(A;;FR;;;WD)S:(AU;SA;FA;;;WD)",
+    ] {
+        assert!(has_dacl_entries(sddl));
+    }
+}