T09 · Insecure Skill Coding Practices
Warning
- Location
tools/generate_copy.js:76- Finding
Unbounded User-Controlled Generation Count Can Cause Resource Exhaustion
- Content
View full analysis
console.log(`${i + 1}. ${t}`)); break; } ``` ```javascript case 'ctas': { const count = parseInt(args[1]) || 5; const ctas = generateCTAs(count); console.log('🎯 CTA 方案：\n'); ctas.forEach((c, i) => console.log(`${i + 1}. ${c}`)); break; } ``` ### Technical Analysis The `titles` and `ctas` commands accept a user-controlled count and pass it to loops that allocate one array element per iteration. There is no maximum permitted count, no `Number.isFinite` check, and no validation that the value is a safe positive integer. A sufficiently large finite value causes excessive CPU consumption and heap growth while the output array is constructed. If construction succeeds, printing every ...[truncated 1826 chars]- Remediation
View remediation
maximum) { throw new Error(`Count must be an integer between 1 and ${maximum}`); } return count; } ``` Use it for both affected commands: ```javascript const count = parseCount(args[2], 10, 100); // titles const count = parseCount(args[1], 5, 100); // CTAs ``` Additional hardening measures should include: 1. Catch validation errors and exit with a clear message and a nonzero status. 2. Apply limits inside `generateTitles` and `generateCTAs` as well as at the CLI boundary, so future programmatic callers cannot bypass validation. 3. Consider streaming generated entries directly rather than retaining the entire result in an array when large output is legitimately needed. 4. Run the utility with process memory, CPU, execution-time, and output-size limits when invoked by a service or agent. 5. Add tests for zero, negative values, non-numeric input, values above the maximum, `Infinity`, and integers outside JavaScript's safe range. ]]>