T09 · Insecure Skill Coding Practices
Warning
- Location
scripts/calculate_targets.js:10- Finding
Missing Numeric and Range Validation Allows Corruption of Nutrition Calculations
- Content
View full analysis
sum + Number(e.water_ml || 0), 0); res.totals.water_ml = round(res.totals.water_ml + addedWater, 1); ``` #### `scripts/calculate_burn.js:18-24` ```js function getExerciseBurn(exercise, weightKg) { const type = exercise.exercise_type || exercise.type; const intensity = exercise.intensity || 'moderate'; const minutes = Number(exercise.duration_min || exercise.duration || 0); const met = (MET[type] && MET[type][intensity]) || 5.0; return round((met * 3.5 * weightKg / 200) * minutes, 0); } ``` ### Technical Analysis The scripts accept profile, food, hydration, and exercise values from JSON input but do not verify that those values are finite numbers within reasonable positive ranges. In `calculate_targets.js`, the condition only checks ...[truncated 2639 chars]- Remediation
View remediation
max) { throw new RangeError(`${field} must not exceed ${max}`); } return number; } ``` Apply the helper to all profile measurements, food quantities, hydration values, and exercise durations before performing arithmetic. 6. **Add boundary and malformed-input tests** - Test negative values, zero where prohibited, numeric strings, empty strings, `null`, arrays, objects, invalid text, very large exponents, `NaN`, and infinite values. - Assert that in ...[truncated 84 chars]