T09 · Insecure Skill Coding Practices
Warning
- Location
- scripts/main.py:121
- Finding
- Non-Finite Numeric Values Bypass Input Validation## Vulnerability Details **File Location**: `scripts/main.py`, lines 121–137, 142, and 164 **Vulnerability Type**: Improper numeric input validation and non-standard JSON serialization **Risk Level**: Medium ### Vulnerable Code ```python def convert(value: float, analyte: str, from_unit: str, to_unit: str) -> dict: """Perform the conversion and return a result dict.""" analyte_key = analyte.lower() from_key = normalise_unit(from_unit) to_key = normalise_unit(to_unit) lookup = (analyte_key, from_key, to_key) if lookup not in CONVERSIONS: supported = ", ".join(SUPPORTED_ANALYTES) print( f"Error: unsupported conversion '{from_unit}' → '{to_unit}' for analyte '{analyte}'.\n" f"Supported analytes: {supported}", file=sys.stderr, ) sys.exit(1) conv = CONVERSIONS[lookup] output_value = round(value * conv["factor"], 4) return { "analyte": analyte, "input_value": value, "input_unit": from_unit, "output_value": output_value, "output_unit": to_unit, "reference_range": conv["reference_range"], } ``` ```python parser.add_argument("--value", type=float, required=True, help="Numeric value to convert") ``` ```python print(json.dumps(result, indent=2)) ``` ### Technical Analysis The `--value` argument uses Python's `float` converter, which accepts special IEEE-754 values such as `nan`, `inf`, and `-inf`. The conversion function does not verify that the parsed value is finite before performing the calculation. Python's default `json.dumps()` behavior permits these values and serializes them as `NaN`, `Infinity`, and `-Infinity`. These tokens are not valid numbers under the strict JSON specification. Consequently, the program can produce medically meaningless results that may either be accepted by permissive consumers or rejected by strict JSON parsers. ### Attack Path 1. Invoke the converter with a supported analyt ...[truncated 1127 chars]
- Remediation
- ## Remediation Suggestions 1. Reject all non-finite values immediately after argument parsing and within `convert()` so direct programmatic callers receive the same protection: ```python import math if not math.isfinite(value): raise ValueError("--value must be a finite numeric value") ``` 2. Convert validation failures into the documented user-facing error: ```python if not math.isfinite(args.value): parser.error("--value must be a finite numeric value") ``` 3. Disable non-standard JSON number serialization as defense in depth: ```python print(json.dumps(result, indent=2, allow_nan=False)) ``` 4. Add tests covering `nan`, `inf`, `-inf`, extremely large finite values, negative values, and ordinary valid values. 5. Consider rejecting negative laboratory measurements or applying documented analyte-specific plausibility limits where medically appropriate. Such limits should be sourced and explicitly documented rather than inferred.