T09 · Insecure Skill Coding Practices
Error
- Location
scripts/trade.py:699- Finding
Live Brokerage Order Cancellation Bypasses Trading Authorization Gates
- Content
View full analysis
dict[str, Any]: target_id = args.order_id open_trades = ib.openTrades() for tr in open_trades: if tr.order.orderId == target_id: ib.cancelOrder(tr.order) ib.sleep(1.0) return { "mode": "live", "action": "cancel", "order_id": target_id, "status_after_cancel": tr.orderStatus.status, } ``` The main authorization logic classifies cancellation as a read-only command: ```python env_enabled = _check_env_gate() # cancel and list-orders don't need gates (cancelling/reading is intrinsically safe) is_readonly_cmd = args.cmd in ("cancel", "list-orders") confirm_flag = getattr(args, "confirm_trade", False) ``` ### Technical Analysis `trade.py` normally protects live order placement with two independent controls: 1. The `IBKR_TRADING_ENABLED=1` environment variable. 2. The per-invocation `--confirm-trade` flag. However, the `cancel` command is treated as read-only and does not expose or enforce these controls. This classification is incorrect because `ib.cancelOrder()` changes live brokerage state. Cancellation can materially change financial exposure. For example, cancelling an exit, stop, hedge, or profit-taking order can leave a position unprotected. The implementation also connects through `ib_connect(..., readonly=False)`, so the broker connection has the authority required to execute the cancellation when the Gateway session permits it. The behavior conflicts with the documented security model in `README.md`, which groups order cancellation with brokerage capabilities that are off b ...[truncated 1612 chars]- Remediation
View remediation