T09 · Insecure Skill Coding Practices
Warning
- Location
- scripts/check-availability.py:25
- Finding
- Fail-Open Calendar Retrieval Can Produce False Availability## Vulnerability Details **File Location**: `scripts/check-availability.py`, lines 25–47 and 66–73 **Vulnerability Type**: Fail-open error handling and incomplete calendar parsing **Risk Level**: Medium ### Vulnerable Code ```python try: result = subprocess.run( ["gog", "calendar", "events", calendar_id, "--from", f"{date_str}T00:00:00", "--to", f"{date_str}T23:59:59"], capture_output=True, text=True, check=True, ) except subprocess.CalledProcessError as e: print(f"Error fetching calendar: {e}", file=sys.stderr) return [] events = [] for line in result.stdout.strip().split("\n"): if not line.strip() or line.startswith("ID"): continue parts = line.split() if len(parts) < 4: continue events.append({ "id": parts[0], "start": parts[1], "end": parts[2], "summary": " ".join(parts[3:]), }) ``` ```python busy = [] for ev in raw_events: try: s = parse_dt(ev["start"], tz) e = parse_dt(ev["end"], tz) busy.append((s, e, ev["summary"], ev["id"])) except Exception as exc: print(f"Warning: skipping event {ev}: {exc}", file=sys.stderr) ``` ### Technical Analysis Calendar retrieval failures are converted into an empty event list. The same effective result occurs when output rows do not match the assumed whitespace-delimited format or when an event timestamp cannot be parsed: affected events are silently omitted. `find_free_slots()` cannot distinguish a genuinely empty calendar from failed or incomplete retrieval. It consequently calculates availability from an empty or partial set of busy periods and may report occupied periods as free. This violates the safer fail-closed behavior expected for scheduling decisions. Although the subprocess invocation uses an argument array and is not vulnerable to shell injection, its output hand ...[truncated 1391 chars]
- Remediation
- ## Remediation Suggestions 1. Fail closed when `gog` exits unsuccessfully. Raise an exception or return an explicit error object instead of returning an empty event list. 2. Prevent free-slot calculation and all downstream scheduling actions unless calendar retrieval completed successfully. 3. Use a structured `gog` output mode such as JSON, if supported, rather than parsing human-readable whitespace-delimited output. 4. Validate every event record, including required fields, timestamp syntax, timezone information, and the condition that the end time is later than the start time. 5. Treat any unparseable event within the requested range as an incomplete availability result rather than silently skipping it. 6. Return explicit status fields such as `availability_status`, `retrieval_complete`, and `errors`, and require callers to verify them. 7. Add tests covering authentication failures, permission failures, malformed rows, all-day events, summaries containing whitespace, timezone offsets, daylight-saving transitions, and partial output.