T09 · Insecure Skill Coding Practices
Warning
- Location
scripts/perler_converter.py:511- Finding
Unbounded Image Dimensions and Cell Size Permit Resource Exhaustion
- Content
View full analysis
200: sys.stderr.write("[错误] 宽度应在 1-200 之间\n") sys.exit(1) ``` The unvalidated values subsequently control image allocation in `scripts/perler_converter.py:276`: ```python img = Image.new("RGB", (w * cell_px, h * cell_px), (255, 255, 255)) ``` When height is omitted, it can also be derived from the source image aspect ratio in `scripts/perler_converter.py:170-176`: ```python out_w = target_w if target_h is not None: out_h = target_h else: out_h = max(1, round(orig_h * target_w / orig_w)) small = img.resi ...[truncated 2602 chars]- Remediation
View remediation
MAX_BEAD_HEIGHT: raise ValueError("Calculated height exceeds the supported limit") if w * h > MAX_TOTAL_BEADS: raise ValueError("Pattern contains too many beads") if w * h * args.cell * args.cell > MAX_OUTPUT_PIXELS: raise ValueError("Requested PNG exceeds the output pixel limit") ``` 4. Inspect source dimensions immediately after opening the image and reject images whose decoded dimensions or pixel count exceed an operationally safe threshold. 5. Catch Pillow allocation, decompression-bomb, and dimension errors. Return a clear failure message rather than allowing an uncontrolled crash. 6. Consider separate limits for interactive and trusted batch use. Any higher limits should require an explicit administrator-controlled configuration rather than requester-controlled arguments. 7. Add tests covering zero, negative, extremely large, and aspect-ratio-derived values for `height` and `cell`, as well as aggregate output-size limits. ]]>