T09 · Insecure Skill Coding Practices
Warning
- Location
scripts/reallocate_budget.py:86- Finding
Unvalidated monetary values can corrupt persistent budget data
- Content
View full analysis
from_remaining: print(f"\n⚠️ Cannot reallocate ${args.amount:.2f}") print(f" {args.from_cat} only has ${from_remaining:.2f} remaining") print(f" Maximum safe reallocation: ${max(0, from_remaining - 20):.2f}") return from_budget['limit'] -= args.amount from_budget['updated_at'] = datetime.now().isoformat() to_budget['limit'] += args.amount to_budget['updated_at'] = datetime.now().isoformat() ``` ### Technical Analysis Using `argparse` with `type=float` verifies only that an argument can be converted to a Python floating-point value. It does not ensure that the value is positive, finite, or within a reasonable range. Consequently, the scripts accept: - Negative budgets, income, expenses, and reallocations - `nan` - Positive or ne ...[truncated 1795 chars]- Remediation
View remediation
1_000_000_000: raise argparse.ArgumentTypeError("Amount exceeds the supported maximum") return amount ``` 2. Apply this validator to every budget, income, expense, and reallocation argument. 3. Reject reallocations where the source and destination categories are identical. 4. Validate loaded JSON against an explicit schema before performing arithmetic. 5. Set `allow_nan=False` when serializing JSON: ```python json.dump(data, f, indent=2, allow_nan=False) ``` 6. Prefer decimal arithmetic using `decimal.Decimal` or store monetary values as integer cents. 7. Add tests for negative values, zero, `nan`, infinity, extreme values, and reversed reallocations. ]]>