T09 · Insecure Skill Coding Practices
Warning
- Location
scripts/market_signals.py:433- Finding
Terminal Escape-Sequence Injection Through Untrusted CSV Fields
- Content
View full analysis
= 0 else "↓" bb = f"{r.get('bb_pct', 'N/A')}" if isinstance(r.get('bb_pct'), (int, float)): bb = f"↓{r['bb_pct']:.1f}" if r['bb_pct'] < 0.2 else f"↑{r['bb_pct']:.1f}" if r['bb_pct'] > 0.8 else f"{r['bb_pct']:.1f}" print(f" {name:<10} {r['current']:>8.2f} " f"{arrow}{abs(r['change_pct']):>5.1f}% " f"{r['rsi'] if r['rsi'] else 'N/A':>6} " f"{r['ma_signal']:<12} {r['vol_signal']:<7} " f"{bb:>7} {r['score']:>3} {r['recommendation']}") ``` ```python for h in history[-max_rows:]: print(f" {h['date']:<12} {h['close']:>8.2f} " f"{h['rsi'] if h['rsi'] else 'N/A':>6} " f"{h['ma_signal']:<8} " f"{h['signal_count']:>6}") ``` ### Technical Analysis The `name` and `date` values originate from the supplied CSV file and are printed directly to the terminal. No validation or neutralization removes ANSI, OSC, C0, or C1 terminal control sequences. Python string formatting controls field width but does not escape embedded control characters. Consequently, a malicious CSV field can contain sequences that alter cursor position, clear previous output, change colors, create deceptive hyperlinks, or invoke terminal-specific features such as OSC clipboard operations. This issue does not provide arbitrary operating-system command execution by itself. Exploitation depends on the control sequences supported and enabled by the terminal emulator in which the script is run. ### Attack Path 1. An attacker creates or modifies a CSV file accepted by the tool. 2. The attacker places terminal escape sequences in a `name` f ...[truncated 1026 chars]- Remediation
View remediation