T09 · Insecure Skill Coding Practices
Warning
- Location
scripts/seo_analyzer.py:177- Finding
User-Controlled Regular Expression Injection in Keyword Analysis
- Content
View full analysis
]*>.*?' + keyword_lower, content_lower, re.I)) ``` ### Technical Analysis The `target_keyword` value is converted to lowercase and concatenated directly into a regular-expression pattern. Because the value is not escaped with `re.escape()`, an attacker can supply regular-expression metacharacters that alter the intended pattern. An invalid expression, such as an unmatched `(`, causes `re.search()` to raise an unhandled `re.error`, terminating the analyzer. More complex expressions can introduce expensive backtracking when evaluated against sufficiently large content, potentially consuming excessive CPU time. The vulnerable value is accepted through the `--keyword` command-line argument and reaches `re.search()` without validation, escaping, or an input-size restriction. ### Attack Path 1. An attacker or untrusted caller supplies a crafted value through `--keyword`. 2. `main()` passes the value to `analyze_content()`, which passes it to `analyze_keywords()`. 3. `analyze_keywords()` stores the lowercase form in `keyword_lower`. 4. The attacker-controlled value is concatenated into the heading-search regular expression. 5. An invalid pattern causes an unhandled exception, while a pathological pattern may cause excessive CPU consumption when applied to large content. 6. The analyzer becomes unavailable or fails to return a result. ### Impact Assessment Successful exploitation does not grant filesystem, network, or operating-system privileges. Its scope is process availability: - Immediate analyzer termination through malformed regular-expression syntax. - Potential CPU exhaustion through pathological backtracking. - Repeated failures in any service or automation pipeline that invokes this script with ...[truncated 168 chars]- Remediation
View remediation
]*>.*?' + escaped_keyword has_in_heading = bool(re.search(pattern, content_lower, re.I)) ``` Additional hardening should include: 1. Limit the maximum accepted length of both content and keyword inputs. 2. Catch `re.error` at the analysis boundary and return a controlled validation error. 3. Consider parsing HTML with a dedicated parser rather than regular expressions. 4. Add regression tests using malformed values such as `(`, `[`, `.*`, and nested repetition patterns. 5. If exposed through a service, apply request-size limits, execution timeouts, and per-client rate limits. ]]>