T09 · Insecure Skill Coding Practices
Warning
- Location
project_mode_skill.py:133- Finding
Greedy Multiline Replacement Can Delete Persistent Project State
- Content
View full analysis
- Remediation
View remediation
" end_marker = "" start = content.find(start_marker) end = content.find(end_marker, start + len(start_marker)) if start == -1 or end == -1: raise ValueError("Task-list section markers are missing") updated = ( content[:start + len(start_marker)] + "\n" + task_lines.rstrip() + "\n" + content[end:] ) ``` 2. If a regular expression remains necessary, use a non-greedy match with an explicit lookahead for the next known heading or section delimiter. Do not rely on `.*` with `re.DOTALL` without a structural boundary. 3. Validate that exactly one section was replaced and that required headings and metadata remain present before writing the result. 4. Write the updated document atomically: - Create a temporary file in the same directory. - Flush and synchronize it. - Replace the destination with `os.replace()` only after validation succeeds. 5. Preserve a backup or versioned copy before modifying persistent project state. 6. Add regression tests containing multiple sections after the task list and verify byte-for-byte that content outside the intended task section remains unchanged. ]]>