GHSA-8359-h9fx-j6v9: datamodel-code-generator vulnerable to arbitrary local file read via JSON-Schema `$ref` (`file://` and `../` traversal), bypassing `--no-allow-remote-refs`

Summary datamodel-code-generator resolves JSON-Schema $ref targets that point at the local filesystem without restricting them to the input/base directory and without honoring the remote-reference security control. In the default configuration, an attacker who controls an input schema (a "paste your OpenAPI/JSON-Schema" service, a CI job that generates models from a submitted spec, or any multi-tenant codegen platform) can read any file the process user can read and map the host filesystem. This works via either a file:// absolute URI or a ../-escaped relative reference, and it succeeds even when --no-allow-remote-refs is set. This is an unauthenticated path-traversal / information-disclosure issue (CWE-22 / CWE-200) plus a bypass of a documented security control. Details is_url() classifies file:// as a URL (reference.py:1249): def is_url(ref: str) -> bool: return ref.startswith(("https://", "http://", "file://")) The remote-ref gate then explicitly exempts file://, so --no-allow-remote-refs never applies to it (parser/jsonschema.py, _get_ref_body): if is_url(resolved_ref): if not resolved_ref.startswith("file://") and self.http_local_ref_path is None: if self.allow_remote_refs is False: raise Error(...) # <-- skipped for file:// ... return self._get_ref_body_from_url(resolved_ref) return self._get_ref_body_from_remote(resolved_ref) Both local-file branches read the target with no containment check. The file:// branch reads any absolute path: _get_ref_body_from_url if ref.startswith("file://"): path = url2pathname(urlparse(ref).path) # absolute path, anywhere on disk return self.remote_object_cache.get_or_put( ref, default_factory=lambda _: load_data_from_path(Path(path), self.encoding)) and the plain relative branch lets ../ escape the base directory: _get_ref_body_from_remote full_path = self.base_path / resolved_ref # no is_relative_to(base_path) check return self.remote_object_cache.get_or_put( str(full_path), default_factory=lambda _: load_data_from