T09 · Insecure Skill Coding Practices
Warning
- Location
- scripts/risk_matrix_calculator.py:146
- Finding
- FMEA Boundary Values Are Assigned a Lower Priority Than Documented## Vulnerability Details **File Location**: `scripts/risk_matrix_calculator.py`, lines 146-156 **Vulnerability Type**: Incorrect boundary validation in safety-related risk classification **Risk Level**: Medium ### Vulnerable Code ```python # Determine priority level if rpn > 200: priority = "Critical" action = "Immediate action required" elif rpn > 100: priority = "High" action = "Action plan required" elif rpn > 50: priority = "Medium" action = "Consider risk reduction" else: priority = "Low" action = "Monitor" ``` ### Technical Analysis The implementation uses strict greater-than comparisons, while the documented thresholds in `references/risk-analysis-methods.md` and `references/risk-assessment-templates.md` specify: - RPN greater than 200: Critical - RPN 100–200: High - RPN 50–100: Medium - RPN below 50: Low Consequently: - An RPN of exactly `50` is classified as **Low** rather than **Medium**. - An RPN of exactly `100` is classified as **Medium** rather than **High**. This is an off-by-one boundary defect in a medical-device risk assessment utility. It causes the executable behavior to conflict with the project’s documented risk-control criteria. ### Attack Path 1. A user or integrated system supplies valid FMEA ratings whose product is exactly 50 or 100. 2. For example, severity `5`, occurrence `5`, and detection `4` produce an RPN of `100`. 3. The condition `rpn > 100` evaluates to false. 4. The condition `rpn > 50` evaluates to true. 5. The calculator reports **Medium** priority and recommends only “Consider risk reduction,” although the documented criteria require **High** priority and an action plan. 6. Similarly, ratings producing an RPN of `50` result in **Low** priority and the recommendation “Monitor,” rather than the documented **Medium** priority. This path does not provide operating-system access or elevated privileges. It may be ...[truncated 721 chars]
- Remediation
- ## Remediation Suggestions Replace the strict comparisons with explicit inclusive boundaries that match the documented policy: ```python if rpn > 200: priority = "Critical" action = "Immediate action required" elif rpn >= 100: priority = "High" action = "Action plan required" elif rpn >= 50: priority = "Medium" action = "Consider risk reduction" else: priority = "Low" action = "Monitor" ``` Additionally: 1. Define the thresholds once as named constants or a shared policy table to prevent divergence between implementation and documentation. 2. Clarify whether RPN `200` belongs to High or Critical and encode that boundary explicitly. 3. Add automated tests for RPN values `49`, `50`, `51`, `99`, `100`, `101`, `199`, `200`, and `201`. 4. Add tests comparing all implemented classifications against the documented ranges. 5. Require review and validation of threshold changes because the results may inform safety-related decisions.