T09 · Insecure Skill Coding Practices
Warning
- Location
scripts/fund_flow.py:413- Finding
Unsanitized CSV Values Permit Terminal Escape-Sequence Injection
- Content
View full analysis
0 else "↓" if r['net_flow'] < 0 else "→" ratio_pct = f"{r['main_ratio']*100:.0f}%" if 'main_ratio' in r else "" print(f" {i:>4} {r['name']:<14} {r['records']:>5} {r['main_flow']:>+14,.0f} " f"{r['retail_flow']:>+14,.0f} {r['net_flow']:>+13,.0f}{direction} {ratio_pct:>6}") ``` ```python sorted_items = sorted(trends.items(), key=lambda x: -abs(x[1]["3day_avg"]))[:top] for name, t in sorted_items: print(f" {name:<14} {t['3day_avg']:>+12,.0f} {t['3day_direction']:<8} " f"{t['5day_avg']:>+12,.0f} {t['5day_direction']:<8} {t['persistence']:>6}") ``` ```python for s in sectors[:top]: direction = "↑" if s['net_flow'] > 0 else "↓" ratio_pct = f"{s['main_ratio']*100:.0f}%" print(f" {s['sector']:<12} {s['items']:>5} {s['members']:>5} {s['main_flow']:>+14,.0f} " f"{s['retail_flow']:>+14,.0f} {s['net_flow']:>+14,.0f} {ratio_pct:>6}") ``` ### Technical Analysis The application treats CSV fields such as stock names and sector names as ordinary display text. These values can contain control characters, including ANSI CSI sequences and OSC sequences, and are passed directly to `print()`. Python string formatting does not neutralize terminal control sequences. When the report is displayed in a compatible terminal emulator, the terminal interprets those bytes as command ...[truncated 2183 chars]- Remediation
View remediation
= 0x20 and ord(ch) != 0x7F ) ``` 2. Sanitize names and sectors at each output boundary: ```python safe_name = sanitize_terminal_text(r["name"]) print(f" {i:>4} {safe_name:<14} ...") ``` 3. Apply the same protection consistently to: - Ranking names. - Trend names. - Sector names. - Any future user-controlled labels, headings, filenames, or error messages. 4. Consider rendering control characters visibly rather than removing them when forensic fidelity is important, for example by replacing them with escaped forms such as `\x1b`. 5. Add automated tests containing CSI, OSC 8, OSC 52, carriage return, backspace, newline, and other C0/C1 control characters. Verify that generated terminal reports contain no executable control sequences. 6. Keep machine-readable JSON output separate from human-readable terminal output. Avoid printing both formats together when `--json` is selected, and document that downstream consumers must safely encode values for their own display context. ]]>