T09 · Insecure Skill Coding Practices
- Location
scripts/pricing-calculator.py:72- Finding
Zero-Value Market Prices Cause an Unhandled Division-by-Zero Error
- Content
View full analysis
Vulnerability Details
File Location:
scripts/pricing-calculator.py, lines 72-75
Vulnerability Type: Improper numeric input validation resulting in denial of service
Risk Level: Lowpython avg_price = sum(market_prices) / len(market_prices) min_price = min(market_prices) max_price = max(market_prices) gap_pct = ((your_price - avg_price) / avg_price) * 100Technical Analysis
The
positioncommand converts user-controlled comma-separated values intomarket_pricesand passes them toanalyze_competitor_position()without validating that the values are finite and positive.If the supplied prices have an average of zero, line 75 divides by zero and raises an unhandled
ZeroDivisionError. Negative values can also be selected so that their sum is zero. Because the program has no exception handler around command processing, the exception terminates the process and prevents a structured result from being returned.An empty or malformed price list can similarly terminate execution through unhandled conversion or aggregation errors, although the directly identified division-by-zero condition is sufficient to demonstrate the issue.
Attack Path
- An attacker or malformed upstream request invokes the calculator's
positioncommand. - The attacker supplies a price list with an average of zero, such as:
bash python3 scripts/pricing-calculator.py position --your-price 1 --prices 0 cmd_position()parses the attacker-controlled value and callsanalyze_competitor_position().avg_pricebecomes0.0.- The calculation of
gap_pctdivides byavg_price. - Python raises an unhandled
ZeroDivisionError, terminating the calculator process.
Impact Assessment
Exploitation causes denial of service for the affected calculator invocation. In an automated pricing pipeline, repeated malformed requests could disrupt report generation or dependent jobs. The issue ...[truncated 153 chars]
- An attacker or malformed upstream request invokes the calculator's
- Remediation
View remediation
Remediation Suggestions
- Reject empty competitor-price lists before performing aggregation.
- Require every market price to be finite and greater than zero.
- Explicitly verify that the calculated average is greater than zero before using it as a divisor.
- Catch
ValueErrorand arithmetic exceptions at the CLI boundary and return a controlled error message with a nonzero exit status. - Add tests covering empty input, malformed values, zero, negative values, values whose sum is zero,
NaN, and positive or negative infinity. - Consider a validation helper such as:
python import math if not market_prices: raise ValueError("At least one market price is required") if any(not math.isfinite(price) or price <= 0 for price in market_prices): raise ValueError("Market prices must be finite positive numbers") avg_price = sum(market_prices) / len(market_prices)