T09 · Insecure Skill Coding Practices
Warning
- Location
- SKILL.md:429
- Finding
- Unvalidated Numeric Inputs Permit Invalid Refund Calculations<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md`, lines 429-443 **Vulnerability Type**: Improper input validation in financial calculations **Risk Level**: Medium ### Vulnerable Code ```python ordered_total = product_price * quantity_ordered if quantity_received == 0: refund_amount = ordered_total else: refund_amount = product_price * ( quantity_ordered - max(quantity_received, quantity_acceptable) ) ``` ### Technical Analysis The refund calculator performs arithmetic directly on caller-controlled price and quantity values without validating their ranges or relationships. In particular, it does not enforce the following expected invariants: ```text product_price >= 0 quantity_ordered >= 0 0 <= quantity_acceptable <= quantity_received <= quantity_ordered ``` If `quantity_received` or `quantity_acceptable` exceeds `quantity_ordered`, the subtraction produces a negative quantity and therefore a negative refund. Negative prices or quantities can also produce invalid totals. Conversely, inconsistent values may result in excessive or otherwise incorrect refund recommendations. The interactive wrapper catches only conversion errors. It does not reject successfully parsed but invalid values. The function itself also exposes no validation boundary, so direct callers can supply arbitrary numeric arguments. Using binary floating-point values for currency additionally creates a risk of rounding discrepancies, although the primary vulnerability is the absence of range and consistency validation. ### Attack Path 1. An attacker or malformed upstream record supplies inconsistent values, such as: ```python calculate_refund( product_price=25.0, quantity_ordered=2, quantity_received=5, quantity_acceptable=0, problem_type="shortage", is_platform_fault=False, ) ``` 2. The function calculates: ```text 25 × (2 - 5) = -75 ``` 3. The negative amount is returned as the recommend ...[truncated 944 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions 1. Validate all inputs inside `calculate_refund`, rather than relying only on the interactive wrapper. 2. Require a finite, non-negative product price. 3. Require integer, non-negative quantities. 4. Enforce the relationship: ```text 0 <= quantity_acceptable <= quantity_received <= quantity_ordered ``` 5. Reject invalid data with a structured validation error; do not silently substitute defaults. 6. Clamp the computed refund to the valid business range only as defense in depth: ```text 0 <= refund_amount <= ordered_total ``` Validation should remain the primary control. 7. Use `decimal.Decimal` with an explicit rounding policy for currency. 8. Add unit tests for negative values, zero values, non-finite values, received quantities greater than ordered quantities, and unusually large values. Example hardening: ```python from decimal import Decimal import math if not math.isfinite(product_price) or product_price < 0: raise ValueError("Product price must be finite and non-negative.") if any( not isinstance(value, int) for value in (quantity_ordered, quantity_received, quantity_acceptable) ): raise TypeError("Quantities must be integers.") if not ( 0 <= quantity_acceptable <= quantity_received <= quantity_ordered ): raise ValueError("Quantity values are inconsistent.") price = Decimal(str(product_price)) ordered_total = price * quantity_ordered ``` ]]>