T09 · Insecure Skill Coding Practices
Warning
- Location
scripts/main.py:27- Finding
Unvalidated Non-Finite Numeric Values Can Terminate Scheduled Monitoring
- Content
View full analysis
float: """Calculate remaining days""" if daily_consumption <= 0: return float('inf') return pressure / daily_consumption def calculate_depletion_time(remaining_days: float) -> datetime: """Calculate estimated depletion time""" return get_current_time() + timedelta(days=remaining_days) ``` The affected values originate from command-line arguments and are passed directly into the calculation: ```python pressure = args.pressure capacity = args.capacity daily_consumption = args.daily_consumption remaining_days = calculate_remaining_days(pressure, daily_consumption) depletion_time = calculate_depletion_time(remaining_days) ``` ### Technical Analysis The application accepts arbitrary floating-point values for pressure and daily consumption without checking whether they are finite or within physically realistic ranges. When `daily_consumption` is zero or negative, `calculate_remaining_days()` deliberately returns positive infinity. That value is then passed to `timedelta(days=remaining_days)`, which cannot represent infinity and raises an exception. Inputs such as `nan`, `inf`, or sufficiently large finite numbers can produce the same outcome. Because no exception handler surrounds the calculation, the process terminates before producing a status code or monitoring report. This is particularly significant when the command is run through the documented cron integration: the failed invocation may suppress the expected depletion alert. ### Attack Path 1. An attacker, malfunctioning sensor integration, or incorrectly configured scheduled task supplies a ma ...[truncated 1716 chars]- Remediation
View remediation
None: if not math.isfinite(pressure) or pressure < 0 or pressure > 20: raise ValueError("Pressure must be a finite value between 0 and 20 MPa") if ( not math.isfinite(daily_consumption) or daily_consumption <= 0 or daily_consumption > 10 ): raise ValueError( "Daily consumption must be a finite positive value no greater than 10 MPa/day" ) if alert_days < 0 or alert_days > 365: raise ValueError("Alert days must be between 0 and 365") ``` 2. Do not represent invalid or unknown consumption as infinite remaining life. Treat zero, negative, missing, and non-finite consumption as sensor or configuration failures. 3. Catch validation and arithmetic errors in `main()` and return a separate operational-error exit code: ```python try: validate_inputs(pressure, daily_consumption, args.alert_days) remaining_days = calculate_remaining_days( pressure, daily_consumption ) depletion_time = calculate_depletion_time(remaining_days) except (ValueError, OverflowError) as exc: print(f"Monitoring input error: {exc}", file=sys.stderr) sys.exit(3) ``` 4. Configure alert automation to escalate exit code `3` as a monitoring-system failure rather than treating it as a normal result. 5. Add automated tests for zero, negative, `nan`, positive and negative infinity, and extreme finite values. ]]>