T09 · Insecure Skill Coding Practices
Error
- Location
- scripts/main.py:65
- Finding
- Unsafe Substring Matching Can Produce Hazardous Chemical Disposal Guidance## Vulnerability Details **File Location**: `scripts/main.py`, lines 65-72 **Vulnerability Type**: Improper input validation and ambiguous substring matching **Risk Level**: High ### Complete Code Snippet ```python def lookup(self, chemical): """Look up disposal category for chemical.""" chemical_lower = chemical.lower().strip() for category, info in self.WASTE_CATEGORIES.items(): if any(chemical_lower in accept or accept in chemical_lower for accept in info["accepts"]): return info return None ``` ### Technical Analysis The lookup routine uses bidirectional substring matching instead of exact, normalized chemical identifiers: ```python chemical_lower in accept or accept in chemical_lower ``` This logic accepts blank, partial, ambiguous, and compound inputs as valid matches. For example: - Whitespace-only input becomes an empty string after `strip()`. Because an empty string is considered a substring of every string, the first entry in the first category matches, causing the input to be classified as halogenated organic waste. - A partial string can match an unintended chemical alias. - An input containing multiple chemicals is classified according to the first matching category in dictionary iteration order. The code does not detect mixtures or conflicting categories. - The method returns immediately after the first match, preventing ambiguity detection. The output presents the result as authoritative disposal guidance, so a false-positive classification is safety-relevant rather than merely a display error. ### Attack Path 1. A user or upstream caller supplies blank, partial, ambiguous, or multi-chemical text through `--chemical`. 2. The application lowercases and strips the text but does not reject empty input or parse mixtures. 3. Bidirectional substring matching identifies the first compatible substring in `WASTE_CATEGORIES`. ...[truncated 1255 chars]
- Remediation
- ## Remediation Suggestions 1. Reject empty or whitespace-only input before attempting a lookup. 2. Replace substring comparisons with exact matching against normalized aliases. 3. Maintain an explicit alias-to-category mapping so that each accepted identifier has deterministic behavior. 4. Detect separators and language indicating mixtures, such as commas, semicolons, slashes, plus signs, or words such as `and` and `with`. 5. Evaluate all matches before returning. If multiple categories match, do not recommend a container; instruct the user to contact Environmental Health and Safety personnel. 6. Treat unknown, partial, or ambiguous names as unresolved rather than selecting the first category. 7. Consider requiring validated identifiers, such as CAS Registry Numbers, for operational use. 8. Add regression tests covering: - Empty and whitespace-only input - Partial chemical names - Unknown substances - Multiple chemicals from the same category - Mixtures belonging to conflicting categories - Aliases with different capitalization and surrounding whitespace 9. Include a clear warning that this limited static database must not replace site-specific EHS procedures or Safety Data Sheet review. A safer lookup pattern would normalize the input and perform exact alias matching: ```python def lookup(self, chemical): chemical_lower = chemical.casefold().strip() if not chemical_lower: return None matches = [ info for info in self.WASTE_CATEGORIES.values() if chemical_lower in {alias.casefold() for alias in info["accepts"]} ] if len(matches) != 1: return None return matches[0] ``` Mixture detection and explicit ambiguous-result handling should be added before presenting any disposal recommendation.