T09 · Insecure Skill Coding Practices
Warning
- Location
- moments_generator.py:75
- Finding
- Unbounded User-Controlled Generation Count Can Cause Resource Exhaustion## Vulnerability Details **File Location**: `moments_generator.py`, lines 75-90 **Vulnerability Type**: Uncontrolled resource consumption caused by missing input validation **Risk Level**: Medium ### Vulnerable Code ```python def generate_moments_content(product_scene: str, style: str = "reseller", count: int = 5): style_info = STYLES.get(style, STYLES["reseller"]) template_pool = { "reseller": RESELLER_TEMPLATES, "promote": PROMOTE_TEMPLATES, "personal_ip": PERSONAL_IP_TEMPLATES, "motivational": MOTIVATIONAL_TEMPLATES, "flash_sale": FLASH_SALE_TEMPLATES }.get(style, RESELLER_TEMPLATES) results = [] used_templates = [] for i in range(count): ``` ### Technical Analysis The documented interface limits `count` to between 3 and 20, but `generate_moments_content` does not enforce that constraint at runtime. Python type annotations do not validate arguments, so callers can provide an arbitrarily large integer. The loop performs work for every requested item and appends a new dictionary to `results` on each iteration. Consequently, execution time and memory usage grow linearly with `count`. Subsequent JSON serialization can require additional CPU and memory proportional to the generated output. This becomes exploitable when an untrusted caller can control `count`, such as through an API, agent tool invocation, job queue, or other externally accessible integration. Exploitability depends on how this function is exposed by the surrounding system. ### Attack Path 1. An attacker reaches an interface that invokes `generate_moments_content`. 2. The attacker supplies an extremely large integer as `count`. 3. The function accepts the value without enforcing the documented maximum of 20. 4. `range(count)` causes the generation loop to execute repeatedly. 5. Each iteration allocates and retains another result object in memory. 6. CPU tim ...[truncated 680 chars]
- Remediation
- ## Remediation Suggestions Validate `count` before entering the generation loop: ```python MIN_COUNT = 3 MAX_COUNT = 20 def generate_moments_content(product_scene: str, style: str = "reseller", count: int = 5): if isinstance(count, bool) or not isinstance(count, int): raise TypeError("count must be an integer") if not MIN_COUNT <= count <= MAX_COUNT: raise ValueError("count must be between 3 and 20") ``` Apply the same constraint at every external entry point, including API request schemas and agent tool parameter schemas. Reject invalid values rather than silently accepting or truncating them so callers receive predictable behavior. Where the function is exposed remotely, also apply request-size limits, execution timeouts, concurrency controls, and rate limiting as defense-in-depth measures. Add tests covering non-integer values, booleans, negative values, zero, boundary values, and integers above the maximum.