T09 · Insecure Skill Coding Practices
Warning
- Location
scripts/doc2markdown.js:148- Finding
Unbounded Response Buffering and ZIP Extraction Enable Resource Exhaustion
- Content
View full analysis
{ const chunks = []; res.on('data', (chunk) => { chunks.push(chunk); }); res.on('end', () => { const buffer = Buffer.concat(chunks); let data; if (options.responseType === 'arraybuffer') { data = buffer; } else { const text = buffer.toString('utf8'); try { data = JSON.parse(text); } catch (e) { data = text; } } resolve({ status: res.statusCode, data: data }); }); }); ``` ```js const entries = []; const diskEntries = buffer.readUInt16LE(pos + 8); const dirStart = buffer.readUInt32LE(pos + 16); pos = dirStart; for (let i = 0; i < diskEntries; i++) { if (buffer.readUInt32LE(pos) !== 0x02014b50) break; const flags = buffer.readUInt16LE(pos + 8); const method = buffer.readUInt16LE(pos + 10); const nameLen = buffer.readUInt16LE(pos + 28); const extraLen = buffer.readUInt16LE(pos + 30); const commentLen = buffer.readUInt16LE(pos + 32); const offset = buffer.readUInt32LE(pos + 42); const name = buffer.toString('utf8', pos + 46, pos + 46 + nameLen); entries.push({ offset, method, name, encrypted: !!(flags & 1) }); pos += 46 + nameLen + extraLen + commentLen; } // Extract each file for (const ent of entries) { if (ent.encrypted || ent.name.endsWith('/')) continue; const o = ent.offset; const sig = buffer.readUInt32LE(o); if (sig !== 0x04034b50) continue; const nameLen = buffer.readUInt16LE(o + 26); const extraLen = buffer.readUInt16LE(o + 28); const csize = buffer ...[truncated 3475 chars]- Remediation
View remediation