T09 · Insecure Skill Coding Practices
Error
- Location
- scripts/schema_guard.py:66
- Finding
- Validation Failures Return a Successful Process Exit Code<![CDATA[ ## Vulnerability Details **File Location**: `scripts/schema_guard.py`, lines 66-82 **Vulnerability Type**: Fail-open validation gate **Risk Level**: High ### Vulnerable Code ```python obj, err = load_json_text(src) if err: issues = [{"field": "(root)", "expected": "合法 JSON", "got": "解析失败", "hint": err}] print(json.dumps({"pass": False, "issues": issues}, ensure_ascii=False, indent=2) if a.json else f"❌ {err}") return issues = validate(obj, schema) if a.json: print(json.dumps({"pass": not issues, "issues": issues}, ensure_ascii=False, indent=2)) else: print(f"校验：{'✅ 通过' if not issues else '🔒 拦截'} 问题：{len(issues)}") for i in issues: print(f" [{i['field']}] 期望 {i['expected']} | 实际 {i['got']} | 修复：{i['hint']}") if __name__ == "__main__": main() ``` ### Technical Analysis The CLI documents exit code `1` for validation failures and exit code `2` for usage or environment errors, but `main()` does not return or raise a nonzero process status when malformed JSON or schema violations are detected. The parsing-failure branch uses a bare `return`, while ordinary validation failures only affect printed output. Python consequently terminates with exit code `0` in both cases. This creates a fail-open validation boundary whenever a shell script, CI job, agent, or downstream program relies on the process status instead of parsing the human-readable output. ### Attack Path 1. A downstream workflow invokes the validator as a security or data-quality gate. 2. The workflow determines success using the command's exit status. 3. An attacker supplies malformed JSON, omits required fields, or provides values that violate the schema. 4. The validator prints a rejection message but exits with status `0`. 5. The calling workflow interprets the command as successful and permits the untrusted output to continue into business logic, storage, or an API. ### Impact Assessment No additio ...[truncated 360 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions 1. Make `main()` return explicit status codes: - `0` when validation succeeds. - `1` when input parsing or validation rejects the submitted data. - `2` when the schema, command-line usage, or execution environment is invalid. 2. Terminate with the returned status: ```python if __name__ == "__main__": raise SystemExit(main()) ``` 3. Ensure both human-readable and JSON output modes use identical exit semantics. 4. Add automated tests that execute the CLI as a subprocess and assert the exit code for valid JSON, malformed JSON, missing required fields, invalid types, invalid enums, unreadable files, and malformed schemas. ]]>