T09 · Insecure Skill Coding Practices
Warning
- Location
- scripts/query_data.py:70
- Finding
- User-Controlled Regular Expression Enables Denial of Service<![CDATA[ ## Vulnerability Details **File Location**: `scripts/query_data.py`, lines 70-71 **Vulnerability Type**: Unvalidated regular-expression processing **Risk Level**: Medium ### Vulnerable Code ```python elif op == "contains": df = df[df[col].astype(str).str.contains(str(val), na=False)] ``` ### Technical Analysis The `contains` filter passes the user-controlled query value directly to `pandas.Series.str.contains()`. This API treats its pattern as a regular expression by default because `regex=True` is implicit. The value originates from the supplied query JSON and is not escaped, validated, complexity-limited, or processed with a timeout. An attacker can therefore provide an invalid expression to trigger query failure or a catastrophically backtracking expression, such as `(a+)+$`, to consume excessive CPU when evaluated against suitably long worksheet values. This operation is performed across every applicable value in the selected column, which can amplify the computational cost on large worksheets. ### Attack Path 1. An attacker supplies or influences an Excel workbook containing many long strings, such as strings composed of repeated `a` characters followed by a nonmatching character. 2. The attacker causes a query to use the `contains` operator against that column. 3. The query JSON contains a computationally expensive regular expression, such as `(a+)+$`. 4. `apply_filters()` passes the expression to `Series.str.contains()` with regular-expression processing enabled. 5. The regular-expression engine performs excessive backtracking for each applicable cell. 6. The query process experiences high CPU consumption, stalls, or becomes unavailable. An invalid regular expression can also raise an exception and force the query to fail, although the surrounding query handler returns the error rather than crashing the entire interpreter. ### Impact Assessment Successful exploitation affects availability. It can monopolize CPU resources, substant ...[truncated 418 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions Treat `contains` as literal substring matching unless regular-expression support is explicitly required: ```python elif op == "contains": df = df[df[col].astype(str).str.contains(str(val), regex=False, na=False)] ``` Additional hardening should include: 1. Define a maximum length for filter values. 2. Reject unsupported operators before processing the query. 3. If regular expressions are required, expose them through a separate operator and validate expression syntax and complexity. 4. Use a timeout-capable or non-backtracking regular-expression engine where possible. 5. Apply process-level CPU and execution-time limits. 6. Return a clear validation error for rejected patterns rather than evaluating them. ]]>