Skip to content

fix: the script accepts year and month values via ra... in...#848

Open
orbisai0security wants to merge 1 commit into
DataTalksClub:mainfrom
orbisai0security:fix-v-003-input-validation-year-month
Open

fix: the script accepts year and month values via ra... in...#848
orbisai0security wants to merge 1 commit into
DataTalksClub:mainfrom
orbisai0security:fix-v-003-input-validation-year-month

Conversation

@orbisai0security
Copy link
Copy Markdown

Summary

Fix high severity security issue in cohorts/2025/workshops/dynamic_load_dlt.py.

Vulnerability

Field Value
ID V-003
Severity HIGH
Scanner multi_agent_ai
Rule V-003
File cohorts/2025/workshops/dynamic_load_dlt.py:43
CWE CWE-190

Description: The script accepts year and month values via raw input() calls and converts them with int() without any range validation or error handling. Values such as year=99999999 or month=99 are silently accepted and passed directly into downstream DLT pipeline logic. This can cause malformed date range construction, unexpected pipeline behavior, integer overflow in date arithmetic, or data corruption in DLT-managed datasets. A ValueError from non-numeric input will also produce an unhandled exception with a full traceback.

Changes

  • cohorts/2025/workshops/dynamic_load_dlt.py

Verification

  • Build passes
  • Scanner re-scan confirms fix
  • LLM code review passed

Automated security fix by OrbisAI Security

Automated security fix generated by Orbis Security AI
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant