T09 · Insecure Skill Coding Practices
Error
- Location
scripts/run_prediction.py:22- Finding
PowerShell Command Injection Through Unvalidated Prediction Date
- Content
View full analysis
- Remediation
View remediation
str: try: parsed = datetime.strptime(value, "%Y-%m-%d") except ValueError as exc: raise ValueError("start_date must use YYYY-MM-DD format") from exc canonical = parsed.strftime("%Y-%m-%d") if value != canonical: raise ValueError("start_date must use canonical YYYY-MM-DD format") return canonical ``` 2. **Avoid constructing a PowerShell command string** Resolve the intended Python executable or use `conda run`, then pass every argument as a separate list element without shell interpretation: ```python validated_date = validate_date(start_date) if not 1 <= samples <= 10000: raise ValueError("samples is outside the permitted range") result = subprocess.run( [ "conda", "run", "-n", CONDA_ENV, "python", ".\\batch_predict.py", "--start_date", validated_date, "--samples", str(samples), ], cwd=PREDICT_DIR, capture_output=True, text=True, shell=False, check=False, ) ``` 3. **Apply explicit bounds to numeric inputs** Although `samples` is parsed as an integer, enforce a reasonable minimum and maximum to prevent resource exhaustion or accidental denial of service. 4. **Do not rely on quoting as the primary defense** PowerShell escaping is complex and context-sensitive. Input validation and argument-array execution without a command shell should be used instead of attempting to escape attacker-controlled text. 5. **Limit execution privileges** Run the prediction process under a dedicated, non-administrative account ...[truncated 343 chars]