T09 · Insecure Skill Coding Practices
Warning
- Location
scripts/main.py:17- Finding
Unvalidated Numeric Inputs Can Produce Misleading Pathogenicity Classifications
- Content
View full analysis
= 0.9: classification = "Pathogenic" elif composite >= 0.7: classification = "Likely Pathogenic" elif composite >= 0.3: classification = "Uncertain Significance" elif composite >= 0.1: classification = "Likely Benign" else: classification = "Benign" ``` ```python variant = { "REVEL": args.revel or 0.5, "CADD": args.cadd or 15, "PolyPhen": args.polyphen or 0.5 } ``` ### Technical Analysis The command-line parser converts supplied scores to Python floating-point values but does not verify that they are finite or within their expected domains. Python accepts special values such as `nan`, `inf`, and `-inf` as floats. Negative values and implausibly large values are also accepted. A `NaN` value propagates into the composite score. Every ordered comparison against `NaN` evaluates to false, causing execution to reach the final `else` branch and classify the variant as `Benign`. Thus, a malformed value fails open to the least severe classification rather than being rejected. The use of expressions such as `args.revel or 0.5` introduces an additional correctness flaw. A legitimate numeric value of `0.0` is false in a Boolean context and is silently replaced with the default. Consequently, users cannot reliably submit valid zero scores. The function also accepts dictionaries directly without validating their types. No ...[truncated 1884 chars]- Remediation
View remediation