T09 · Insecure Skill Coding Practices
Warning
- Location
- scripts/printf.py:3
- Finding
- Unrestricted Format Width Can Cause Resource Exhaustion## Vulnerability Details **File Location**: `scripts/printf.py`, line 3 **Vulnerability Type**: Unbounded attacker-controlled format width **Risk Level**: Medium ### Vulnerable Code ```python print(sys.argv[1] % tuple(sys.argv[2:]), end='') ``` ### Technical Analysis The first command-line argument is used directly as a Python `%` format string without validation or size restrictions. Python formatting supports caller-defined field widths. A format such as `%999999999s` can therefore instruct the interpreter to construct an extremely large padded string. No limits are imposed on the format-string length, individual field widths, or total formatted output size. The script also lacks exception handling for formatting and memory failures. This creates a denial-of-service condition when untrusted input can reach the utility. ### Attack Path 1. An attacker supplies an excessively large field width as the first command-line argument, for example `%999999999s`. 2. The attacker supplies a compatible value as a subsequent argument. 3. Line 3 passes the untrusted format string directly to Python's `%` formatting operation. 4. Python attempts to allocate and construct the requested padded output. 5. The process consumes excessive memory and CPU, potentially being terminated or degrading the host service. ### Impact Assessment Exploitation does not grant additional privileges, code execution, or access to sensitive information. Its impact is limited to availability: the script process may crash or be killed, and an Agent or service invoking it may become unavailable. Repeated or concurrent exploitation can increase resource pressure and affect other workloads on the same host.
- Remediation
- ## Remediation Suggestions - Do not pass an arbitrary caller-controlled string directly to Python's formatting operator. - Parse the format string and allowlist only the documented conversion specifiers, flags, precision forms, and width forms. - Enforce conservative maximum values for format-string length, field width, precision, argument count, and total rendered output. - Reject dynamic widths or other unsupported formatting constructs. - Convert arguments to validated target types before formatting. - Catch formatting exceptions and return a controlled error without emitting partial output or a traceback. - Where the utility is exposed by an Agent or service, also apply process-level memory, CPU, execution-time, and output-size limits.