T09 · Insecure Skill Coding Practices
- Location
scripts/check-availability.py:25- Finding
Fail-Open Calendar Retrieval Can Produce False Availability
- Content
View full analysis
Vulnerability Details
File Location:
scripts/check-availability.py, lines 25–47 and 66–73
Vulnerability Type: Fail-open error handling and incomplete calendar parsing
Risk Level: MediumVulnerable Code
python try: result = subprocess.run( ["gog", "calendar", "events", calendar_id, "--from", f"{date_str}T00:00:00", "--to", f"{date_str}T23:59:59"], capture_output=True, text=True, check=True, ) except subprocess.CalledProcessError as e: print(f"Error fetching calendar: {e}", file=sys.stderr) return [] events = [] for line in result.stdout.strip().split("\n"): if not line.strip() or line.startswith("ID"): continue parts = line.split() if len(parts) < 4: continue events.append({ "id": parts[0], "start": parts[1], "end": parts[2], "summary": " ".join(parts[3:]), })python busy = [] for ev in raw_events: try: s = parse_dt(ev["start"], tz) e = parse_dt(ev["end"], tz) busy.append((s, e, ev["summary"], ev["id"])) except Exception as exc: print(f"Warning: skipping event {ev}: {exc}", file=sys.stderr)Technical Analysis
Calendar retrieval failures are converted into an empty event list. The same effective result occurs when output rows do not match the assumed whitespace-delimited format or when an event timestamp cannot be parsed: affected events are silently omitted.
find_free_slots()cannot distinguish a genuinely empty calendar from failed or incomplete retrieval. It consequently calculates availability from an empty or partial set of busy periods and may report occupied periods as free. This violates the safer fail-closed behavior expected for scheduling decisions.Although the subprocess invocation uses an argument array and is not vulnerable to shell injection, its output hand ...[truncated 1391 chars]
- Remediation
View remediation
Remediation Suggestions
- Fail closed when
gogexits unsuccessfully. Raise an exception or return an explicit error object instead of returning an empty event list. - Prevent free-slot calculation and all downstream scheduling actions unless calendar retrieval completed successfully.
- Use a structured
gogoutput mode such as JSON, if supported, rather than parsing human-readable whitespace-delimited output. - Validate every event record, including required fields, timestamp syntax, timezone information, and the condition that the end time is later than the start time.
- Treat any unparseable event within the requested range as an incomplete availability result rather than silently skipping it.
- Return explicit status fields such as
availability_status,retrieval_complete, anderrors, and require callers to verify them. - Add tests covering authentication failures, permission failures, malformed rows, all-day events, summaries containing whitespace, timezone offsets, daylight-saving transitions, and partial output.
- Fail closed when