T09 · Insecure Skill Coding Practices
Warning
- Location
main.py:91- Finding
Unbounded Description Count Allows Local Resource Exhaustion
- Content
View full analysis
list: """批量生成商品描述""" descriptions = [] for i in range(count): description = self.generate_description(product, platform, style, audience) descriptions.append({ "description": description, "platform": platform, "style": style, "estimated_conversion": random.randint(200, 500), "estimated_click_rate": random.randint(150, 350), "recommendation_score": random.randint(80, 100) }) return sorted(descriptions, key=lambda x: x["recommendation_score"], reverse=True) ``` The value is read directly from a command-line argument without validation: ```python elif sys.argv[i] == "--count": count = int(sys.argv[i + 1]) i += 2 ``` ### Technical Analysis The attacker-controlled `--count` value is passed directly to `range(count)`. Every iteration generates a description and appends a dictionary to an in-memory list. After generation, the entire list is sorted, adding further CPU and memory overhead. No upper limit, execution budget, or output-size restriction is enforced. A sufficiently large positive integer can therefore make the process consume excessive memory and CPU time. The boundary test in `test_boundary.py` expects generation to be limited to ten results, but the implementation does not enforce that intended restriction. Negative values do not trigger this issue because `range()` produces no iterations, but very large positive values are exploitable. ### Attack Path 1. An attacker or untrusted automation invokes the CLI wit ...[truncated 1014 chars]- Remediation
View remediation
MAX_COUNT: raise ValueError(f"Count must be between 1 and {MAX_COUNT}") ``` 2. Use `argparse` to validate command-line arguments: ```python import argparse parser = argparse.ArgumentParser() parser.add_argument("--product", required=True) parser.add_argument("--count", type=int, choices=range(1, 11), default=3) args = parser.parse_args() ``` 3. Apply the limit inside `generate_descriptions()`, not only in the CLI, because the class may also be called programmatically. 4. Add automated tests for zero, negative, malformed, boundary, and excessive count values. 5. If larger workloads are later required, use streaming or pagination instead of accumulating and sorting all results in memory. ]]>