T09 · Insecure Skill Coding Practices
Warning
- Location
- scripts/analyze_run.py:17
- Finding
- Unbounded Parsing of User-Supplied XML Files<![CDATA[ ## Vulnerability Details **File Location**: `scripts/analyze_run.py`, lines 17-18 and 58-59 **Vulnerability Type**: Unrestricted XML resource consumption **Risk Level**: Medium ### Vulnerable Code ```python def parse_gpx(file_path): """Parse a GPX file.""" try: tree = ET.parse(file_path) root = tree.getroot() ``` ```python def parse_tcx(file_path): """Parse a TCX file.""" try: tree = ET.parse(file_path) root = tree.getroot() ``` ### Technical Analysis The documented workflow invokes `analyze_run.py` on TCX or GPX files supplied by users. Both parsing functions pass the input directly to `xml.etree.ElementTree.parse()` without first enforcing limits on file size, XML nesting, element count, track-point count, memory consumption, or processing time. `ElementTree.parse()` constructs an in-memory representation of the XML document. An attacker can therefore provide an unusually large or deeply structured GPX or TCX file that consumes excessive memory or CPU while being parsed or traversed. The subsequent loops over tracks, segments, laps, and track points can further amplify processing costs. This finding concerns resource exhaustion. The reviewed code does not establish an arbitrary-code-execution or data-exfiltration path through the XML parser. ### Attack Path 1. An attacker creates a `.gpx` or `.tcx` file containing a very large number of nested elements or track points. 2. The attacker provides the file for analysis. 3. Following the workflow in `SKILL.md`, the Agent executes: ```bash python scripts/analyze_run.py attacker-supplied.gpx --output json ``` 4. `parse_gpx()` or `parse_tcx()` calls `ET.parse()` on the unrestricted file. 5. The parser builds the XML tree in memory, after which the script iterates through its elements. 6. Excessive memory or CPU consumption can stall the process, terminate it through an out-of-memory condition, or disrupt the surrounding Agent session. ### ...[truncated 518 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions 1. **Enforce an input-size limit before parsing.** Inspect the file size with `os.path.getsize()` and reject files exceeding a conservative application-specific threshold. 2. **Use a hardened XML parser.** Replace the standard parser with `defusedxml.ElementTree` to gain safer handling of hostile XML constructs: ```python from defusedxml import ElementTree as ET ``` 3. **Apply structural limits.** Prefer streaming parsing with `iterparse()` and abort when limits are exceeded, including: - Maximum element count - Maximum nesting depth - Maximum number of activities, laps, tracks, or track points - Maximum text and attribute lengths 4. **Reject dangerous or unnecessary XML constructs.** Explicitly reject documents containing DTD or entity declarations when they are not required for valid GPX or TCX processing. 5. **Constrain execution resources.** Run file analysis with memory and CPU limits and, where supported, a processing timeout. Perform parsing in an isolated worker so a malformed file cannot terminate the primary Agent process. 6. **Validate expected document structure.** Confirm that the root element and namespace match supported GPX or TCX formats before processing the full document. 7. **Return controlled errors.** Catch resource-limit and hardened-parser exceptions and report a generic invalid-or-oversized-file error without exposing unnecessary host details. ]]>