T09 · Insecure Skill Coding Practices
Warning
- Location
SKILL.md:73- Finding
Unvalidated Cron Expressions Cause Scheduler Failure and Incorrect Execution Times
- Content
View full analysis
str: parts = cron_expr.strip().split() if len(parts) != 5: return datetime.now().isoformat() minute, hour, day, month, weekday = parts now = datetime.now() if minute == "*" and hour == "*": next_time = now + timedelta(minutes=1) elif minute != "*" and hour == "*": m = int(minute) next_time = now.replace(minute=m, second=0, microsecond=0) if next_time <= now: next_time += timedelta(hours=1) elif minute != "*" and hour != "*": h, m = int(hour), int(minute) next_time = now.replace(hour=h, minute=m, second=0, microsecond=0) if next_time <= now: next_time += timedelta(days=1) else: next_time = now + timedelta(hours=1) return next_time.isoformat() ``` ### Technical Analysis The scheduler accepts a cron expression and splits it into five fields, but it does not validate the syntax or permitted numeric ranges before converting fields with `int()` and passing them to `datetime.replace()`. The documentation presents expressions such as `*/5 * * * *` as supported. For that expression, the `minute != "*"` and `hour == "*"` branch attempts to evaluate `int("*/5")`, raising an uncaught `ValueError`. Numeric expressions outside valid time ranges, such as `99 99 * * *`, can similarly raise exceptions during integer conversion or `datetime.replace()`. The implementation also ignores the `day`, `month`, and `weekday` fields after parsing them. Consequently, weekly and monthly expressions documented by the skill are treated as daily schedules. Invalid expressions containing other unsupported syntax may therefore either terminate task creation or produce a materially incorrect next-run timestam ...[truncated 1120 chars]- Remediation
View remediation