T09 · Insecure Skill Coding Practices
Note
- Location
sub-skills/stock-balance-all-stocks-specific-period/scripts/handler.py:33- Finding
Unbounded HTTP Requests and Response Reads Can Cause Denial of Service
- Content
View full analysis
- Remediation
View remediation
MAX_RESPONSE_BYTES: raise ValueError("Response exceeds the permitted size") body = resp.read(MAX_RESPONSE_BYTES + 1) if len(body) > MAX_RESPONSE_BYTES: raise ValueError("Response exceeds the permitted size") data = json.loads(body.decode("utf-8")) ``` 3. Catch and report expected failure classes without exposing unnecessary remote response details: ```python except urllib.error.HTTPError as exc: print(f"Remote API returned HTTP {exc.code}", file=sys.stderr) sys.exit(1) except urllib.error.URLError as exc: print(f"Remote API request failed: {exc.reason}", file=sys.stderr) sys.exit(1) except (TimeoutError, UnicodeDecodeError, json.JSONDecodeError, ValueError) as exc: print(f"Invalid or incomplete API response: {exc}", file=sys.stderr) sys.exit(1) ``` 4. Validate resource-related arguments before making the request: ```python if args.page < 1: parser.error("--page must be at least 1") if not 1 <= args.page_size <= 100: parser.error("--page-size must be between 1 and 100") ``` 5. Apply the same timeout, bounded-read, argument-validation, and exception-handling controls consistently across all ten handlers, preferably through a shared HTTP helper to prevent configuration drift. ]]>