T09 · Insecure Skill Coding Practices
- Location
scripts/main.py:121- Finding
Non-Finite Numeric Values Bypass Input Validation
- Content
View full analysis
Vulnerability Details
File Location:
scripts/main.py, lines 121–137, 142, and 164
Vulnerability Type: Improper numeric input validation and non-standard JSON serialization
Risk Level: MediumVulnerable Code
python def convert(value: float, analyte: str, from_unit: str, to_unit: str) -> dict: """Perform the conversion and return a result dict.""" analyte_key = analyte.lower() from_key = normalise_unit(from_unit) to_key = normalise_unit(to_unit) lookup = (analyte_key, from_key, to_key) if lookup not in CONVERSIONS: supported = ", ".join(SUPPORTED_ANALYTES) print( f"Error: unsupported conversion '{from_unit}' → '{to_unit}' for analyte '{analyte}'.\n" f"Supported analytes: {supported}", file=sys.stderr, ) sys.exit(1) conv = CONVERSIONS[lookup] output_value = round(value * conv["factor"], 4) return { "analyte": analyte, "input_value": value, "input_unit": from_unit, "output_value": output_value, "output_unit": to_unit, "reference_range": conv["reference_range"], }python parser.add_argument("--value", type=float, required=True, help="Numeric value to convert")python print(json.dumps(result, indent=2))Technical Analysis
The
--valueargument uses Python'sfloatconverter, which accepts special IEEE-754 values such asnan,inf, and-inf. The conversion function does not verify that the parsed value is finite before performing the calculation.Python's default
json.dumps()behavior permits these values and serializes them asNaN,Infinity, and-Infinity. These tokens are not valid numbers under the strict JSON specification. Consequently, the program can produce medically meaningless results that may either be accepted by permissive consumers or rejected by strict JSON parsers.Attack Path
- Invoke the converter with a supported analyt ...[truncated 1127 chars]
- Remediation
View remediation
Remediation Suggestions
-
Reject all non-finite values immediately after argument parsing and within
convert()so direct programmatic callers receive the same protection:python import math if not math.isfinite(value): raise ValueError("--value must be a finite numeric value") -
Convert validation failures into the documented user-facing error:
python if not math.isfinite(args.value): parser.error("--value must be a finite numeric value") -
Disable non-standard JSON number serialization as defense in depth:
python print(json.dumps(result, indent=2, allow_nan=False)) -
Add tests covering
nan,inf,-inf, extremely large finite values, negative values, and ordinary valid values. -
Consider rejecting negative laboratory measurements or applying documented analyte-specific plausibility limits where medically appropriate. Such limits should be sourced and explicitly documented rather than inferred.
-