T09 · Insecure Skill Coding Practices
Warning
- Location
pkg/skill_health/load.py:49- Finding
Unbounded CSV and Compressed ZIP Processing Can Cause Resource Exhaustion
- Content
View full analysis
pd.DataFrame | None: """Read a CSV file from disk. Returns None if missing or empty.""" if not path.exists(): return None try: raw_df = pd.read_csv(path) except Exception as e: logger.warning("Could not read %s: %s", path, e) return None if raw_df.empty: return None return raw_df def _load_csv_from_zip( zip_file: zipfile.ZipFile, member_name: str ) -> pd.DataFrame | None: """Read a CSV member from an open ZIP. Returns None if missing or empty.""" if member_name not in zip_file.namelist(): return None try: with zip_file.open(member_name) as f: raw_df = pd.read_csv(f) except Exception as e: logger.warning("Could not read %s from ZIP: %s", member_name, e) return None if raw_df.empty: return None return raw_df ``` The affected ZIP-loading path is: ```python if data_path.suffix.lower() == ".zip": with zipfile.ZipFile(data_path, "r") as zip_file: steps_df = _normalize_and_dedupe_steps( _load_csv_from_zip(zip_file, "steps.csv") ) heart_rate_df = _normalize_and_dedupe_heart_rate( _load_csv_from_zip(zip_file, "heart_rate.csv") ) calories_df = _normalize_and_dedupe_calories( _load_csv_from_zip(zip_file, "calories.csv") ) sleep_sessions_df = _normalize_sleep( _load_csv_from_zip(zip_file, "sleep_sessions.csv") ) exercise_sessions_df = _normalize_exercise( _load_csv_from_zip(zip_file, "exercise_sessions.csv") ) oxygen_saturation_df = _normalize_oxy ...[truncated 2862 chars]- Remediation
View remediation