T09 · Insecure Skill Coding Practices
Warning
- Location
scripts/script.sh:111- Finding
Unbounded Histogram Bin Count Permits Resource Exhaustion
- Content
View full analysis
2 else "" bins = int(sys.argv[3]) if len(sys.argv) > 3 else 10 def parse_csv(path): with open(path, newline="", encoding="utf-8-sig") as f: reader = csv.DictReader(f) rows = list(reader) return reader.fieldnames or [], rows def to_float(v): try: return float(v) except: return None def ascii_hist(name, values, bins=10, width=40): nums = sorted(v for v in (to_float(x) for x in values) if v is not None) if not nums: print(f"[{name}] no numeric data"); return mn, mx = min(nums), max(nums) if mn == mx: print(f"[{name}] all values equal {mn}"); return step = (mx - mn) / bins counts = [0] * bins ``` ### Technical Analysis The `plot` command accepts `bins` directly from a command-line argument. Python converts it to an integer but does not enforce a valid range before using it in arithmetic and list allocation. The statement `counts = [0] * bins` allocates memory proportional to the attacker-controlled value. An extremely large positive value can consume all available process or system memory. Other invalid values also cause availability failures: - `bins = 0` causes division by zero when calculating `step`. - A negative value creates an empty list and can trigger subsequent indexing or aggregation errors. - A non-integer value raises an uncaught `ValueError`. The argument is passed safely as a positional argument rather than interpolated into Python source, so this issue does not provide com ...[truncated 1307 chars]- Remediation
View remediation
3 else 10 except ValueError: print("The bin count must be an integer.", file=sys.stderr) sys.exit(2) MAX_BINS = 1000 if not 1 <= bins <= MAX_BINS: print(f"The bin count must be between 1 and {MAX_BINS}.", file=sys.stderr) sys.exit(2) ``` Additional hardening measures should include: 1. Document the accepted range in `SKILL.md` and command help. 2. Return controlled error messages rather than Python tracebacks. 3. Apply operating-system or container memory and CPU limits when processing untrusted input. 4. Add tests for zero, negative, non-integer, and excessively large bin counts. ]]>