T09 · Insecure Skill Coding Practices
Warning
- Location
- scripts/optical_kernel.py:82
- Finding
- Unbounded Input Vector Processing Enables Resource Exhaustion## Vulnerability Details **File Location**: `scripts/optical_kernel.py`, lines 82-96 and 130-131 **Vulnerability Type**: Missing input-size and finite-number validation **Risk Level**: Medium ### Vulnerable Code ```python # Validation if len(vec_a) != len(vec_b): raise ValueError("Vectors must have same dimension") # To simulate kernel K(a, b) = |<a|b>|^2, we can encode 'a' in mode 0 and 'b' in mode 1 # BUT, physically, we usually prepare two separate states and interfere them. # Here, we will map scalars to phases in a 2-mode system for a single feature dimension demo, # OR map vectors to temporal modes. # Simplest for this demo skill: # Encode scalar x in mode 0 phase, scalar y in mode 1 phase. # Interfere on BS. Detect output. # If x == y, constructive/destructive interference happens predictably. # Let's perform element-wise kernel estimation for vectors kernel_sum = 0 for i in range(len(vec_a)): ``` ```python vec_a = [float(x) for x in args.vector_a.split(",")] vec_b = [float(x) for x in args.vector_b.split(",")] ``` ### Technical Analysis The simulator advertises an eight-mode resource limit, but that limit does not constrain the length of vectors accepted by `compute_kernel()`. The function verifies only that both vectors have equal lengths and then performs one simulation for every element. A new two-mode `OpticalQuantumSimulator` is created during every iteration, so its `num_modes > 8` check always passes. Consequently, the documented mode limit does not bound the total amount of work. Runtime scales linearly with attacker-controlled vector length and includes repeated NumPy allocations and matrix operations. The parser also accepts values recognized by Python's `float()` as `nan`, `inf`, or `-inf`. These values can propagate through complex exponentiation and matrix calculations, producing invalid or misleading kernel results. Empty vectors are not explicitly rejecte ...[truncated 1937 chars]
- Remediation
- ## Remediation Suggestions 1. Define and enforce a maximum vector length before entering the simulation loop. Apply the check inside `compute_kernel()` so programmatic callers cannot bypass it. ```python MAX_VECTOR_LENGTH = 8 if len(vec_a) != len(vec_b): raise ValueError("Vectors must have the same dimension") if not vec_a: raise ValueError("Vectors must not be empty") if len(vec_a) > MAX_VECTOR_LENGTH: raise ValueError( f"Vector dimension exceeds the limit of {MAX_VECTOR_LENGTH}" ) ``` 2. Reject non-finite values after parsing and again at the public function boundary: ```python arr_a = np.asarray(vec_a, dtype=float) arr_b = np.asarray(vec_b, dtype=float) if not np.all(np.isfinite(arr_a)) or not np.all(np.isfinite(arr_b)): raise ValueError("Vectors must contain only finite numeric values") ``` 3. If the simulator is exposed through an API, independently enforce request-body size limits, execution timeouts, concurrency limits, and per-client rate limits. 4. Ensure documentation accurately distinguishes the number of optical modes from the maximum accepted vector dimension. 5. Add tests covering oversized vectors, empty vectors, unequal vector lengths, `NaN`, positive and negative infinity, and input values near the configured maximum.