T09 · Insecure Skill Coding Practices
Warning
- Location
skills/modeling/scripts/verify_docx_figures.py:32- Finding
Unbounded DOCX Decompression and XML Parsing Can Cause Resource Exhaustion
- Content
View full analysis
ET.Element: with zipfile.ZipFile(docx_path) as zf: try: return ET.fromstring(zf.read("word/document.xml")) except KeyError as exc: raise RuntimeError("word/document.xml not found; file may not be a valid DOCX") from exc ``` From `skills/modeling/scripts/verify_docx_math.py:47-52`: ```python def read_document_xml(docx_path: Path) -> str: with zipfile.ZipFile(docx_path) as zf: try: return zf.read("word/document.xml").decode("utf-8") except KeyError as exc: raise RuntimeError("word/document.xml not found; file may not be a valid DOCX") from exc ``` From `skills/modeling/scripts/verify_docx_typography.py:53-68`: ```python def read_xml(zf: zipfile.ZipFile, name: str) -> ET.Element | None: try: return ET.fromstring(zf.read(name)) except KeyError: return None def iter_xml_parts(zf: zipfile.ZipFile) -> list[tuple[str, ET.Element]]: names = list(TEXT_PARTS) names.extend(name for name in zf.namelist() if name.startswith("word/header") and name.endswith(".xml")) names.extend(name for name in zf.namelist() if name.startswith("word/footer") and name.endswith(".xml")) parts = [] for name in dict.fromkeys(names): root = read_xml(zf, name) if root is not None: parts.append((name, root)) return parts ``` ### Technical Analysis DOCX files are ZIP archives. All three validation scripts accept a caller-selected DOCX file and use `ZipFile. ...[truncated 2546 chars]- Remediation
View remediation