T09 · Insecure Skill Coding Practices
Warning
- Location
scripts/markdown_to_feishu_post.py:33- Finding
Malformed Mention Syntax Causes an Infinite Parsing Loop
- Content
View full analysis
name at_match = re.match(r'([^<]*)', text[pos:]) if at_match: elem = {"tag": "at", "user_id": at_match.group(1)} if inherited_styles: elem["style"] = list(set(inherited_styles)) elements.append(elem) pos += at_match.end() continue ``` ```python # Plain text - collect until next special character plain_text = "" while pos < length: char = text[pos] if char in '*~`[([^<]*) ``` However, the plain-text scanner stops on the substantially broader prefix: ```regex ` therefore fails the complete mention parser but s ...[truncated 2025 chars]- Remediation
View remediation
([^<]*)' ) ``` 3. Add a defensive progress guard around the outer loop: ```python while pos < length: iteration_start = pos # Existing parsing logic... if pos == iteration_start: elements.append({ "tag": "text", "text": text[pos], **({"style": list(set(inherited_styles))} if inherited_styles else {}) }) pos += 1 ``` 4. Treat malformed markup as ordinary text or return a controlled validation error. Do not allow partially recognized syntax to halt consumption. 5. Add regression tests covering at least: ```text name name ``` Each test should verify that parsing terminates within a bounded time and that malformed input is either preserved as text or rejected with a defined error. 6. If this converter is exposed through a service, additionally apply request-size limits, execution timeouts, worker isolation, and rate limiting as defense-in-depth measures. ]]>