T09 · Insecure Skill Coding Practices
Note
- Location
scripts/quickstart.js:8- Finding
Unvalidated Polling Controls Permit Unbounded and Excessive API Requests
- Content
View full analysis
= maxPolls) { console.error('Polling timed out.'); process.exit(1); } await sleep(pollIntervalMs); } ``` ### Technical Analysis `DOCMIND_POLL_INTERVAL_MS` and `DOCMIND_MAX_POLLS` are converted with `Number()` but are not checked for finiteness, integer form, positivity, or safe bounds. For example, setting `DOCMIND_MAX_POLLS=NaN` produces JavaScript's `NaN` value. Every comparison of the form `polls >= NaN` evaluates to `false`, so the maximum-poll termination condition cannot be reached. Setting `DOCMIND_POLL_INTERVAL_MS=0`, a negative value, or a nonnumeric value can cause `setTimeout()` to use an effectively immediate delay. Combining these values allows the loop to issue rapid requests without enforcing its intended maximum. The issue is limited to users or automation able to control the script's environment; it does not independently grant access to the host or Alibaba Cloud credentials. ### Attack Path 1. An attacker or untrusted automation controls environment variables supplied to the process. 2. The attacker sets: ```bash DOCMIND_MAX_POLLS=NaN DOCMIND_POLL_INTERVAL_MS=0 ``` 3. The script converts these strin ...[truncated 914 chars]- Remediation
View remediation
max) { throw new Error( `${name} must be an integer between ${min} and ${max}` ); } return value; } const pollIntervalMs = readBoundedInteger( 'DOCMIND_POLL_INTERVAL_MS', 10000, 1000, 60000 ); const maxPolls = readBoundedInteger( 'DOCMIND_MAX_POLLS', 120, 1, 7200 ); ``` Additional hardening measures should include: 1. Rejecting invalid configuration before creating the API client or submitting a job. 2. Enforcing both a poll-count limit and an absolute elapsed-time deadline. 3. Applying exponential backoff with a maximum delay when transient API failures occur. 4. Catching API exceptions and terminating cleanly after a bounded number of retries. 5. Documenting the accepted numeric ranges for both environment variables. 6. Adding tests for `NaN`, `Infinity`, negative values, zero, fractional values, and excessively large integers. ]]>