T09 · Insecure Skill Coding Practices
- Location
scripts/cantonfair-planner.py:342- Finding
Unbounded Schedule Generation Enables Local Resource Exhaustion
- Content
View full analysis
Vulnerability Details
File Location:
scripts/cantonfair-planner.py, lines 342-371 and 407-410
Vulnerability Type: Uncontrolled resource consumption
Risk Level: MediumVulnerable Code
python plan = [] for day in range(1, days + 1): day_plan = { "day": day, "activities": [], "focus": "" } if day == 1: day_plan["focus"] = "Pre-event preparation" day_plan["activities"] = [ "Confirm booth location and admission documents", "Prepare samples and promotional materials", "Review the target buyer list", "Prepare business cards and sample catalogs" ] elif day == 2: day_plan["focus"] = "Event development" day_plan["activities"] = [ f"Visit halls associated with {fair_phase}", "Collect business cards and requirement information", "Immediately follow up with interested customers", "Record customer requirements and budgets" ] else: day_plan["focus"] = "Post-event follow-up" day_plan["activities"] = [ "Organize and archive customer information", "Send thank-you email or WhatsApp message", "Arrange sample confirmation", "Create a subsequent follow-up plan" ] plan.append(day_plan)The corresponding command-line argument accepts any integer without an upper bound:
python p_plan.add_argument('--days', type=int, default=3, help='Plan duration in days')Technical Analysis
The
--daysvalue is parsed as an unrestricted Python integer and passed directly togenerate_development_plan. The function creates one dictionary containing several strings and lists for every integer inrange(1, days + 1). Every generated object remains in theplanlist until the complete result is serialized wit ...[truncated 2196 chars]- Remediation
View remediation
Remediation Suggestions
-
Enforce a small, documented range appropriate for event planning, such as 1 through 30 days:
python def bounded_days(value: str) -> int: days = int(value) if not 1 <= days <= 30: raise argparse.ArgumentTypeError( "--days must be between 1 and 30" ) return days p_plan.add_argument( "--days", type=bounded_days, default=3, help="Plan duration in days, from 1 to 30" ) -
Add defense-in-depth validation inside
generate_development_planso direct library callers cannot bypass CLI validation:python MAX_PLAN_DAYS = 30 if not isinstance(days, int) or isinstance(days, bool): raise TypeError("days must be an integer") if not 1 <= days <= MAX_PLAN_DAYS: raise ValueError( f"days must be between 1 and {MAX_PLAN_DAYS}" ) -
If larger plans are a legitimate requirement, generate entries incrementally rather than retaining the entire schedule in memory, and impose response-size, execution-time, and memory limits at the service or worker boundary.
-
Add automated tests for zero, negative, non-integer, boundary, and extremely large values to ensure invalid durations are rejected before iteration begins.
-
Where the script is exposed through an API or job runner, apply request validation, rate limits, timeouts, output-size limits, and per-worker memory constraints.
-