T09 · Insecure Skill Coding Practices
Warning
- Location
handler.ts:91- Finding
Unvalidated and Unbounded Log Input Enables Denial of Service
- Content
View full analysis
- Remediation
View remediation
MAX_LOGS) { errors.push(`"logs" must contain no more than ${MAX_LOGS} entries`); } ``` 2. Validate every log entry using a strict schema: - Require each entry to be a non-null object. - Require `timestamp` and `message` to be strings. - Restrict `level` to `error`, `warn`, `info`, or `debug`. - Permit `context` and `stack` only when they are strings. - Reject unexpected or structurally invalid values. 3. Bound attacker-controlled strings, for example: - `message`: 4,096 characters. - `context`: 512 characters. - `stack`: a documented, defensible maximum. - `timestamp`: a short ISO-8601 string. 4. Validate timestamps with strict parsing and reject invalid values before analysis. 5. Apply a request-body size limit at the Agent or runtime boundary so oversized payloads are rejected before allocation and deserialization. 6. Avoid repeated full-array scans where practical. Compute error, warning, and slow-operation counts during a single bounded pass. 7. Return structured validation errors rather than relying on runtime exceptions from operations such as `.slice()`. 8. Add tests covering null fields, missing fields, invalid levels, oversized strings, more than 10,000 entries, sparse arrays, and non-object array elements. ]]>