T09 · Insecure Skill Coding Practices
Warning
- Location
ada_predictor.py:28- Finding
Bypassable Input Validation and Unbounded Monte Carlo Resource Consumption
- Content
View full analysis
dict: rng = np.random.default_rng(42) scores = [] for _ in range(n_sim): p = PatientProfile( biologic=patient.biologic, is_monoclonal_ab=patient.is_monoclonal_ab, concomitant_mtx=patient.concomitant_mtx, mtx_dose_mg_wk=patient.mtx_dose_mg_wk, hla_dqa1_05=patient.hla_dqa1_05, prior_biologic_failures=patient.prior_biologic_failures, baseline_crp_mg_l=max(0, rng.normal(patient.baseline_crp_mg_l, patient.baseline_crp_mg_l * 0.2)), disease_duration_years=patient.disease_duration_years, smoking=patient.smoking, bmi=max(15, rng.normal(patient.bmi, 2)), ) scores.append(compute_ada_risk(p)["risk_score"]) scores = np.array(scores) return { "mean_score": float(np.mean(scores)), "std_score": float(np.std(scores)), "ci_95": [float(np.percentile(scores, 2.5)), float(np.percentile(scores, 97.5))], "p_high_risk": float(np.mean(scores > 50)), "n_simulations": n_sim, } ``` ### Technical Analysis `PatientProfile.validate()` uses Python `assert` statements to enforce all accepted ranges. Assertions are intended for internal debugging rather than validation of potent ...[truncated 2586 chars]- Remediation
View remediation
None: allowed_biologics = { "adalimumab", "infliximab", "etanercept", "golimumab", "certolizumab" } if self.biologic not in allowed_biologics: raise ValueError(f"Unknown biologic: {self.biologic}") if not isinstance(self.prior_biologic_failures, int) or isinstance( self.prior_biologic_failures, bool ): raise TypeError("prior_biologic_failures must be an integer") if not 0 <= self.prior_biologic_failures <= 10: raise ValueError("prior_biologic_failures must be between 0 and 10") numeric_ranges = { "baseline_crp_mg_l": (self.baseline_crp_mg_l, 0, 500), "disease_duration_years": (self.disease_duration_years, 0, 80), "bmi": (self.bmi, 10, 80), } for name, (value, minimum, maximum) in numeric_ranges.items(): if isinstance(value, bool) or not isinstance(value, (int, float)): raise TypeError(f"{name} must be numeric") if not math.isfinite(value): raise ValueError(f"{name} must be finite") if not minimum <= value <= maximum: raise ValueError(f"{name} must be between {minimum} and {maximum}") if self.concomitant_mtx: if ( isinstance(self.mtx_dose_mg_wk, bool) or not isinstance(self.mtx_dose_mg_wk, (int, float)) or not math.isfinite(self.mtx_dose_mg_wk) or not 0 < self.mtx_dose_mg_wk <= 30 ): raise ValueError("mtx_dose_mg_wk must be finite and between 0 and 30") ``` 2. Validate and cap the simulation count before allocating memory or beginning work: ```python MAX_SIMULATIONS = 100_000 def monte_carlo_sensitivity( patient: PatientProfile, n_sim: int = 5000 ) -> dict: if not isinstance(n_sim, int) or isinstance(n_sim, bool ...[truncated 757 chars]