T09 · Insecure Skill Coding Practices
Note
- Location
axiom_cron_whisperer.py:53- Finding
Malformed cron fields can bypass validation and trigger runtime exceptions
- Content
View full analysis
List[int]: """ Parse a single cron field into a sorted list of values. Supports: *, N, N,M, N-M, */N """ values = set() for part in field.split(","): # Step if "/" in part: base, step = part.split("/", 1) step = int(step) if base == "*": start, end = min_val, max_val elif "-" in base: start, end = map(int, base.split("-", 1)) else: start = int(base) end = max_val for v in range(start, end + 1, step): if min_val <= v <= max_val: values.add(v) # Range elif "-" in part: start, end = map(int, part.split("-", 1)) for v in range(start, end + 1): if min_val <= v <= max_val: values.add(v) # Wildcard elif part == "*": for v in range(min_val, max_val + 1): values.add(v) # Exact value else: v = int(part) if min_val <= v <= max_val: values.add(v) else: raise ValueError(f"Valeur {v} hors limites [{min_val}-{max_val}]") return sorted(values) ``` ```python def _format_value_list(values: List[int], names: List[str] = None) -> str: """Format a list of values, using names if available.""" if names: return ", ".join(names[v] if 0 <= v < len(names) else str(v) for v in values) if len(values) == 1: return str(values[0]) if len(values) == max(values) - min(values) + 1: return f"{min(values)}-{max(values)}" return ", ".join(str(v) for v i ...[truncated 2920 chars]- Remediation
View remediation
end`. 2. Validate step values explicitly: - Require `step > 0`. - Reject zero and negative steps with `ValueError`. - Validate the base range before constructing `range()`. 3. Reject empty results before returning from `parse_field()`: ```python if not values: raise ValueError("Cron field does not contain any valid values") ``` 4. Correct the progression check in `explain_minute()` so that at least three values exist before accessing index 2: ```python if ( len(minutes) > 2 and minutes[1] - minutes[0] == minutes[2] - minutes[1] and minutes[0] == 0 ): ``` For two-value sequences, either format the values directly or implement a progression check that does not require a third element. 5. Add defensive handling in `_format_value_list()`: ```python if not values: raise ValueError("Cannot format an empty cron field") ``` 6. Add regression tests for: - Entirely out-of-range ranges. - Partially out-of-range ranges. - Descending ranges. - Zero and negative steps. - Empty list results. - Two-element minute lists such as `0,30`. - Consistency between `is_valid()` and `explain()`. ]]>