T09 · Insecure Skill Coding Practices
Warning
- Location
scripts/read_book.py:45- Finding
Unbounded Decompression and Parsing of Untrusted Ebook Files
- Content
View full analysis
str: """Read a file from the ZIP archive and attempt several decodings.""" raw = z.read(fpath) for enc in ('utf-8', 'utf-8-sig', 'gbk', 'latin-1'): try: return raw.decode(enc) except Exception: continue return raw.decode('utf-8', errors='ignore') ``` ```python with zipfile.ZipFile(epub_path, 'r') as z: html_files = [f for f in z.namelist() if f.endswith(('.html', '.xhtml', '.htm'))] print(f"[search] Total HTML files: {len(html_files)}; keyword: {keyword}", file=sys.stderr) for f in html_files: try: content = _read_file(z, f) if keyword not in content: continue text_len = len(re.sub(r'<[^>]+>', ' ', content)) if text_len < 2000: print(f"[skip] {f} -> only {text_len} characters", file=sys.stderr) continue kw_count = content.count(keyword) density = kw_count * 1000 / max(text_len, 1) matches.append((f, text_len, kw_count, density, content)) ``` ```python reader = PdfReader(pdf_path) full_text = '' for i, page in enumerate(reader.pages): full_text += (page.extract_text() or '') full_text += f'\n--- Page {i + 1} ---\n' ``` ### Technical Analysis The script accepts locally supplied EPUB and PDF files and processes them without resource budgets. For EPUB files, every HTML member is read with `ZipFile.read()`, which decompresses the complete member into memory. The script does not validate: - The number of archive members. - The compressed or uncompressed size o ...[truncated 2070 chars]- Remediation
View remediation