T09 · Insecure Skill Coding Practices
Warning
- Location
- scripts/main.py:12
- Finding
- Non-positive duration values produce misleading low-risk assessments<![CDATA[ ## Vulnerability Details **File Location**: `scripts/main.py:12-21` and `scripts/main.py:31` **Vulnerability Type**: Missing input validation **Risk Level**: Medium ### Vulnerable Code ```python base_risk = duration_hours * 0.5 packaging_factor = {"dry-ice": 0.8, "liquid-nitrogen": 0.3, "gel-packs": 1.2} risk = base_risk * packaging_factor.get(packaging, 1.0) print(f"Route: {route}") print(f"Duration: {duration_hours} hours") print(f"Packaging: {packaging}") print(f"Risk score: {risk:.2f}") if risk < 10: return "Low risk" elif risk < 20: return "Medium risk" else: return "High risk" ``` ```python parser.add_argument("--duration", "-d", type=int, required=True, help="Duration in hours") ``` ### Technical Analysis The command-line parser verifies only that `duration` is an integer. It does not enforce a positive lower bound. Consequently, zero or negative transport durations are accepted and used directly in the risk calculation. A negative duration produces a negative risk score. Because every negative score satisfies `risk < 10`, the application labels the result as `Low risk`, even though the input is physically invalid. This is a validation flaw at a trust boundary and can compromise the integrity of the generated assessment. ### Attack Path 1. An operator or attacker supplies an invalid negative duration, for example: ```bash python scripts/main.py --route "NYC-Boston" --duration -100 --packaging dry-ice ``` 2. The parser accepts `-100` because it is a valid integer. 3. The calculation produces `-100 × 0.5 × 0.8 = -40`. 4. The condition `risk < 10` evaluates as true. 5. The program reports a risk score of `-40.00` and a risk level of `Low risk`. ### Impact Assessment The flaw does not grant additional operating-system privileges, file access, network access, or code execution. Its scope is limited to the integrity and reliability of the risk-calculation output. Nevertheless, invalid or attacker-controlled input ...[truncated 258 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions Enforce a positive duration before performing the calculation. Prefer validation at argument parsing time so invalid values are rejected before reaching business logic. ```python def positive_int(value): try: parsed = int(value) except ValueError as exc: raise argparse.ArgumentTypeError("Duration must be an integer") from exc if parsed <= 0: raise argparse.ArgumentTypeError("Duration must be greater than zero") return parsed parser.add_argument( "--duration", "-d", type=positive_int, required=True, help="Duration in hours; must be greater than zero", ) ``` For defense in depth, `calculate_risk()` should also reject non-positive durations so callers cannot bypass CLI validation: ```python def calculate_risk(route, duration_hours, packaging): if duration_hours <= 0: raise ValueError("Duration must be greater than zero") ``` Add automated tests covering zero, negative values, valid boundary values, very large durations, and non-integer input. Invalid values should result in a controlled error and a nonzero exit status rather than a risk classification. ]]>