T09 · Insecure Skill Coding Practices
- Location
scripts/solscan.py:28- Finding
Unbounded HTTP Request Can Cause Indefinite Process Blocking
- Content
View full analysis
Vulnerability Details
File Location:
scripts/solscan.py:28
Vulnerability Type: Missing HTTP connection and read timeout
Risk Level: LowVulnerable Code
python try: response = requests.get(url, headers=headers, params=params) response.raise_for_status() return response.json() except requests.exceptions.RequestException as e: print(f"API Request Error: {e}", file=sys.stderr) if hasattr(e, 'response') and e.response is not None: print(f"Response Body: {e.response.text}", file=sys.stderr) sys.exit(1)Technical Analysis
The
requests.get()call does not specify a timeout. The Requests library therefore permits the operation to wait indefinitely if the remote endpoint or a network intermediary accepts the connection but fails to complete the response.Because every command routes through
make_request(), the issue affects all account, token, transaction, NFT, block, market, program, and API-usage queries.Attack Path
- A user or agent invokes any supported Solscan command.
make_request()sends an HTTPS GET request to the fixed Solscan API endpoint.- The endpoint or an intervening network component accepts the request but delays or withholds response data.
- With no connection or read timeout, the process remains blocked indefinitely.
- Repeated blocked invocations may consume available worker capacity and degrade service availability.
Exploitation requires influence over the remote service or relevant network path. The destination is fixed in the code, so ordinary command-line input cannot redirect the request to an attacker-controlled host.
Impact Assessment
The impact is limited to availability. An affected process can hang, delay task completion, and consume an execution worker. Concurrent stalled calls may cause resource exhaustion.
The flaw does not grant additional system privileges, enable arbitrary code execution, expose local files, or redirect the API key to anot ...[truncated 117 chars]
- Remediation
View remediation
Remediation Suggestions
Set explicit connection and read timeouts:
python response = requests.get( url, headers=headers, params=params, timeout=(5, 30), )Handle timeout failures separately so callers receive a clear error:
python except requests.exceptions.Timeout: print("API Request Error: Solscan request timed out.", file=sys.stderr) sys.exit(1)For transient failures, consider a
requests.Sessionconfigured with a small, bounded retry count and exponential backoff. Retries should apply only to safe transient conditions and must preserve an overall execution deadline.