T09 · Insecure Skill Coding Practices
Warning
- Location
scripts/render-cp2k-input.py:115- Finding
Unsanitized Request Fields Permit CP2K Input Directive Injection
- Content
View full analysis
str: explicit = raw.get("xc_functional") if isinstance(explicit, str) and explicit.strip(): return explicit.strip().upper() defaults.append("Defaulted xc_functional=PBE") return "PBE" ``` ```python def infer_basis_and_potential(job: Dict[str, Any], raw: Dict[str, Any], defaults: List[str], review: List[str]) -> None: if isinstance(raw.get("basis_family"), str) and raw["basis_family"].strip(): job["basis_family"] = raw["basis_family"].strip() if isinstance(raw.get("potential_family"), str) and raw["potential_family"].strip(): job["potential_family"] = raw["potential_family"].strip() ``` ```python def format_kind_blocks(elements: List[str], basis_family: str, xc: str) -> str: chunks = [] for e in elements: chunks.append( "\n".join([ f" &KIND {e}", f" BASIS_SET {basis_for(e, basis_family)}", f" POTENTIAL {potential_for(e, xc)}", " &END KIND", ]) ) return "\n".join(chunks) ``` ```python sections += [ periodic_poisson(job['periodicity']), " &QS", " METHOD GPW", " &END QS", scf_block(job), " &MGRID", f" CUTOFF {job['cutoff']}", f" REL_CUTOFF {job['rel_cutoff']}", " &END MGRID", " &XC", " &XC_FUNCTIONAL", f" &{job['xc_functional'].upper()}\n &END {job['xc_functional'].upper()}", " &END XC_FUNCTIONAL", ``` ### Technical Analysis The normalizer accepts arbitrary strings ...[truncated 2287 chars]- Remediation
View remediation