T09 · Insecure Skill Coding Practices
Error
- Location
scripts/xr-call:37- Finding
Insufficient Validation and Failure-Stop Enforcement for Physical Movement Commands
- Content
View full analysis
dict[str, Any]: """解析 argv[2:] 中的 --key value 参数。""" kwargs: dict[str, Any] = {} i = 2 while i < len(sys.argv): arg = sys.argv[i] if not arg.startswith("--"): print(json.dumps({"ok": False, "message": f"参数必须以 -- 开头: {arg}"}), file=sys.stderr) sys.exit(1) key = arg[2:].replace("-", "_") if i + 1 < len(sys.argv) and not sys.argv[i + 1].startswith("--"): raw = sys.argv[i + 1] i += 2 # 尝试转数值 try: raw = int(raw) except ValueError: try: raw = float(raw) except ValueError: pass kwargs[key] = raw else: kwargs[key] = True i += 1 return kwargs ``` Movement and turning dispatch at `scripts/xr-call:128-164`: ```python elif cmd == "move": import rclpy from xrrobot_offline_voice.mcp_handlers import move as _move ctx = _init_ros_and_context("xrrobot_offline_voice") kwargs = _parse_args() direction = kwargs.pop("direction", "") if direction not in ("forward", "backward"): print(json.dumps({"ok": False, "message": "direction 必须是 forward 或 backward"})) _shutdown(ctx.ros_node, rclpy) sys.exit(1) try: result = _move(direction=direction, context=ctx, **kwargs) print(json.dumps(result, ensure_ascii=False, default=str)) except Exception as e: print(json.dumps({"ok": False, "message": str(e)})) _shutdown(ctx.ros_node, rclpy) eli ...[truncated 3811 chars]- Remediation
View remediation