T09 · Insecure Skill Coding Practices
Warning
- Location
scripts/image_helper.py:224- Finding
Unbounded Image Scaling Can Cause Resource Exhaustion
- Content
View full analysis
Image.Image: """ Scale image by specified factor. Args: img: PIL Image object factor: Scale factor (e.g., 2.0 for 2x zoom) Returns: Scaled image """ if factor <= 0: raise ValueError("Scale factor must be positive") new_size = (int(img.width * factor), int(img.height * factor)) return img.resize(new_size, resample=Image.LANCZOS) ``` The unrestricted factor is exposed through the CLI: ```python scale_group = parser.add_mutually_exclusive_group() scale_group.add_argument('--scale-preset', metavar='NAME', help='Scale by preset (x2, x3, x4)') scale_group.add_argument('--scale', type=float, metavar='FACTOR', help='Scale by factor (e.g., 2 for 2x)') ``` ### Technical Analysis The scaling function verifies only that the factor is positive. It does not enforce a maximum scale factor, output width, output height, total pixel count, or estimated memory requirement. It also does not explicitly reject non-finite values. The caller controls the scaling factor through `--scale`. The same operation can also be supplied through pipeline JSON. The calculated image dimensions grow linearly with the factor, while the number of output pixels and approximate memory requirements grow quadratically. For example, scaling a 4,000 × 4,000 image by a factor of 100 requests an output image containing approximately 160 billion pixels. Pillow may attempt a very large allocation or perform substantial processing before failing. Image input and base64 decoding are also not subject to explicit applicat ...[truncated 1593 chars]- Remediation
View remediation
Image.Image: if not math.isfinite(factor) or factor <= 0 or factor > MAX_SCALE_FACTOR: raise ValueError( f"Scale factor must be finite and between 0 and {MAX_SCALE_FACTOR}" ) new_width = int(img.width * factor) new_height = int(img.height * factor) if ( new_width <= 0 or new_height <= 0 or new_width > MAX_WIDTH or new_height > MAX_HEIGHT or new_width * new_height > MAX_PIXELS ): raise ValueError("Requested output image exceeds resource limits") return img.resize((new_width, new_height), resample=Image.LANCZOS) ``` ]]>