T09 · Insecure Skill Coding Practices
- Location
scripts/validate.py:15- Finding
Malformed JSON Values Cause Unhandled Validator Exceptions
- Content
View full analysis
Vulnerability Details
File Location:
scripts/validate.py, lines 15-43
Vulnerability Type: Improper input type validation and unhandled exceptions
Risk Level: LowVulnerable Code
python def validate_post(data: dict) -> tuple[bool, list[str]]: """Validate a Moltbook post payload.""" errors = [] warnings = [] # Critical: content field (not text!) if 'text' in data: errors.append("❌ 'text' field detected - use 'content' instead (text → null bug)") if 'content' not in data: errors.append("❌ 'content' field missing (required)") elif not data['content'] or not data['content'].strip(): errors.append("❌ 'content' is empty") # Required fields if 'title' not in data or not data.get('title', '').strip(): warnings.append("⚠️ 'title' missing or empty") if 'submolt' not in data: warnings.append("⚠️ 'submolt' missing (will default to 'general')") return len(errors) == 0, errors + warnings def validate_comment(data: dict) -> tuple[bool, list[str]]: """Validate a Moltbook comment payload.""" errors = [] if 'text' in data: errors.append("❌ 'text' field detected - use 'content' instead") if 'content' not in data: errors.append("❌ 'content' field missing (required)") elif not data['content'] or not data['content'].strip(): errors.append("❌ 'content' is empty") return len(errors) == 0, errorsTechnical Analysis
json.loads()accepts every valid JSON type, including objects, arrays, strings, numbers, booleans, andnull. The validator nevertheless assumes that the decoded root value is a dictionary and that fields such ascontentandtitleare strings.Consequently:
- A root value such as
nullor a number can raiseTypeErrorduring membership tests such as'text' in data.
...[truncated 1956 chars]
- A root value such as
- Remediation
View remediation
Remediation Suggestions
Validate both the root JSON type and individual field types before performing dictionary or string operations:
python def require_object(payload): if not isinstance(payload, dict): return False, ["❌ Payload must be a JSON object"] return True, [] def is_nonempty_string(value): return isinstance(value, str) and bool(value.strip())Apply these checks before calling either validation function:
python if not isinstance(payload, dict): print("❌ Payload must be a JSON object") sys.exit(1)Validate fields explicitly rather than calling
.strip()on arbitrary values:python content = data.get("content") if "content" not in data: errors.append("❌ 'content' field missing (required)") elif not isinstance(content, str): errors.append("❌ 'content' must be a string") elif not content.strip(): errors.append("❌ 'content' is empty")Perform equivalent type checks for
titleand any other string fields. Add a final defensive exception handler in the command-line entry point so unexpected input produces a controlled nonzero exit status without a traceback.Add regression tests covering:
- Root values of
null, numbers, booleans, strings, and arrays. contentandtitlevalues that are numbers, arrays, objects, booleans, ornull.- Empty and whitespace-only strings.
- Both post and comment modes.
- Root values of