T09 · Insecure Skill Coding Practices
Error
- Location
scripts/translate_pptx_text.py:198- Finding
Unhardened XML and ZIP Processing of Untrusted PPTX Files
- Content
View full analysis
list[str]: source_pattern = pattern_for(source_lang) found: Counter[str] = Counter() for name in iter_text_files(list(files), prefixes): root = etree.fromstring(files[name]) for paragraph in root.findall(".//a:p", namespaces=NS): text, _ = paragraph_text_nodes(paragraph) if text and matches_source_lang(text, source_lang) and not should_skip(text, skip_patterns): found[text] += 1 ``` The entire PPTX archive is also loaded into memory without limits: ```python with zipfile.ZipFile(temp_path, "r") as src: files = {name: src.read(name) for name in src.namelist()} ``` The scan-only implementation uses the same pattern: ```python with zipfile.ZipFile(path) as archive: for name in archive.namelist(): if not name.endswith(".xml") or not any(name.startswith(prefix) for prefix in prefixes): continue root = etree.fromstring(archive.read(name)) ``` ### Technical Analysis PPTX files are ZIP archives containing attacker-controlled XML. The scripts pass this XML directly to `lxml.etree.fromstring()` without constructing a hardened parser that explicitly disables DTD loading, external entity resolution, and network access. They also do not reject `DOCTYPE` declarations. In addition, ZIP entries are read without limits on: - Total uncompressed package size - Individual entry size - Number of entries - Compression ratio - XML depth, nod ...[truncated 1732 chars]- Remediation
View remediation