T09 · Insecure Skill Coding Practices
Warning
- Location
- detect_file_type/cli.py:50
- Finding
- Unbounded Default Stdin Spooling Can Exhaust Disk Space## Vulnerability Details **File Location**: `detect_file_type/cli.py`, lines 50–56 **Vulnerability Type**: Unbounded resource consumption through stdin **Risk Level**: Medium ```python try: with os.fdopen(fd, "wb") as tmp: while True: chunk = sys.stdin.buffer.read(STDIN_SPOOL_CHUNK_BYTES) if not chunk: break tmp.write(chunk) ``` ### Technical Analysis The default `spool` stdin mode copies the entire input stream into a temporary file without enforcing a maximum size. The loop terminates only when stdin reaches end-of-file. Consequently, an oversized or indefinitely generated stream can cause continuous growth of the temporary file. The temporary file is securely created with `tempfile.mkstemp` and is removed in a `finally` block, but these measures do not prevent disk exhaustion while the process is running. The optional `head` mode has a configurable memory cap, but the default `spool` mode has no corresponding disk limit. `SECURITY.md` acknowledges this condition and delegates mitigation to external operational controls rather than enforcing it in the application. ### Attack Path 1. An attacker gains the ability to provide data to a service, automation workflow, or command pipeline that invokes `detect_file_type -`. 2. The tool uses its default `--stdin-mode spool` behavior. 3. The attacker supplies a very large stream or a stream that does not terminate. 4. The loop continuously writes incoming data to the temporary filesystem. 5. Available disk space or the caller's storage quota is exhausted before Magika classification begins. 6. The detection process and other applications sharing the filesystem may fail or become unavailable. ### Impact Assessment Exploitation does not grant code execution, additional permissions, or access beyond the invoking user's privileges. Its primary impact is availability: the attacker can consume temporary-file ...[truncated 264 chars]
- Remediation
- ## Remediation Suggestions - Add a maximum spool size that is enforced by default. - Track the cumulative number of bytes written and abort before writing data beyond the configured limit. - Provide a clearly named option such as `--stdin-max-spool-bytes` for trusted workflows that require a different limit. - Return a clear error and nonzero exit status when the size limit is exceeded. - Preserve cleanup through the existing `finally` block. - Consider checking available disk space and applying operating-system or container storage quotas as defense in depth. - Add tests covering input exactly at the limit, input exceeding the limit, very large input, cleanup after rejection, and nonterminating producers subject to process-level timeouts. - Document the enforced default and advise callers not to disable or excessively increase it for attacker-controlled streams.