[SECURITY] MEDIUM: --detail argument silently defaults when out of range #7

New Issue

shoko · 2026-03-25T10:38:53+01:00

shoko commented

2026-03-25 10:38:53 +01:00

Severity: MEDIUM

The --detail N argument is used to index into result["match_events"] without proper bounds checking. It silently defaults to index 0 when out of range.

Location

scripts/browse.py lines 778-785 (main())

Current Behavior

idx = args.detail - 1  # User provides 1-indexed
if idx < 0 or idx >= len(result["match_events"]):
    idx = 0  # Silently defaults to first event

Recommended Fix

Warn user if index is out of range instead of silently defaulting:

idx = args.detail - 1
if idx < 0 or idx >= len(result["match_events"]):
    print(f"WARNING: --detail {args.detail} is out of range (1-{len(result['match_events'])}). Showing event 1.")
    idx = 0

Reference

See reviews/2026-03-25.md Section 6.5

## Severity: MEDIUM The `--detail N` argument is used to index into `result["match_events"]` without proper bounds checking. It silently defaults to index 0 when out of range. ## Location `scripts/browse.py` lines 778-785 (`main()`) ## Current Behavior ```python idx = args.detail - 1 # User provides 1-indexed if idx < 0 or idx >= len(result["match_events"]): idx = 0 # Silently defaults to first event ``` ## Recommended Fix Warn user if index is out of range instead of silently defaulting: ```python idx = args.detail - 1 if idx < 0 or idx >= len(result["match_events"]): print(f"WARNING: --detail {args.detail} is out of range (1-{len(result['match_events'])}). Showing event 1.") idx = 0 ``` ## Reference See `reviews/2026-03-25.md` Section 6.5

shoko added the medium security labels 2026-03-25 10:38:53 +01:00

shoko referenced this issue

2026-03-25 10:40:34 +01:00

[SECURITY] polymarket-browse: Security Audit Tracking (2026-03-25) #3

shoko closed this issue

2026-03-27 04:10:02 +01:00

Sign in to join this conversation.

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: shoko/jujutsu-skills#7