T09 · Insecure Skill Coding Practices
Warning
- Location
scripts/main.py:27- Finding
Unvalidated Numeric Inputs Can Crash or Disable Automated Monitoring
- Content
View full analysis
float: """Calculate remaining days""" if daily_consumption <= 0: return float('inf') return pressure / daily_consumption def calculate_depletion_time(remaining_days: float) -> datetime: """Calculate estimated depletion time""" return get_current_time() + timedelta(days=remaining_days) ``` The command-line arguments are parsed as unrestricted floating-point values: ```python parser.add_argument( "--pressure", "-p", type=float, default=8.0, help="Current tank pressure (MPa), default 8.0" ) parser.add_argument( "--daily-consumption", "-d", type=float, default=1.5, help="Daily consumption rate (MPa/day), default 1.5" ) parser.add_argument( "--alert-days", "-a", type=int, default=2, help="Alert threshold in days, default 2" ) ``` ### Technical Analysis The program does not verify that pressure and consumption values are finite, positive, and within physically reasonable limits. Python's `float()` parser accepts special values such as `nan`, `inf`, and `-inf`. A zero or negative consumption value is converted to positive infinity by `calculate_remaining_days()`. That value is then passed to `timedelta(days=remaining_days)`, which can raise `OverflowError` or another arithmetic conversion exception. Non-finite or excessively large pressure values can produce the same result. Negative pressure and negative alert thresholds are also accepted, potentially producing misleading status calculations rather than a sensor-data validation failure. No exception handler converts these failures into an explicit monitoring-error alert. ### Att ...[truncated 1252 chars]- Remediation
View remediation
None: if not math.isfinite(pressure) or pressure < 0 or pressure > 20: raise ValueError("Pressure must be finite and between 0 and 20 MPa") if not math.isfinite(daily_consumption) or daily_consumption <= 0: raise ValueError("Daily consumption must be finite and greater than zero") if alert_days < 0 or alert_days > 30: raise ValueError("Alert threshold must be between 0 and 30 days") ``` ]]>