T09 · Insecure Skill Coding Practices
Warning
- Location
scripts/analyze-polymarket-football.ts:256- Finding
Unbounded --days Option Enables Resource and API-Quota Exhaustion
- Content
View full analysis
getFixturesByDate(apiKey, day))); fixtures = nested.flat(); } ``` ```ts function datesAround(date: string, days: number): string[] { const base = new Date(`${date}T12:00:00Z`); const results: string[] = []; for (let offset = -days; offset <= days; offset += 1) { const next = new Date(base); next.setUTCDate(base.getUTCDate() + offset); results.push(next.toISOString().slice(0, 10)); } return results; } ``` ### Technical Analysis The `--days` argument is checked only for decimal digits. It has no maximum value and is not validated with `Number.isSafeInteger()`. The supplied number controls the loop in `datesAround()`, which attempts to construct `2 × days + 1` date entries. Every generated date is subsequently converted into an authenticated API-Football request. All requests are started together through `Promise.all()`, with no concurrency limit, request budget, timeout, or early termination after a satisfactory fixture is found. Normal operation requires only a narrow date range—the documented default is one day on either side of the inferred date. Permitting an arbitrary range therefore exceeds the minimum network and API privileges needed for the declared fixture-matching functionality. ### Attack Path 1. An attacker or untrusted automation supplies a valid Polymarket input or slug and a very large argument, such as `--days 1000000`. 2. Argument parsing accepts the ...[truncated 1347 chars]- Remediation
View remediation
7 ) { throw new Error("--days must be an integer between 0 and 7."); } options.days = parsed; ``` 2. Apply the same validation inside the exported `analyzePolymarketFootball()` function. Library callers can bypass CLI parsing and currently supply an arbitrary `days` value directly. 3. Replace unbounded `Promise.all()` execution with sequential processing or a small concurrency pool. 4. Stop searching once a sufficiently confident fixture has been found rather than querying every date in the configured range. 5. Add request timeouts and a per-analysis request budget to prevent stalled or excessive third-party calls. 6. Add tests covering negative values, unsafe integers, extremely large values, and direct library calls that bypass command-line validation. ]]>