T09 · Insecure Skill Coding Practices
Warning
- Location
scripts/trade_tracker.py:368- Finding
Untrusted CSV Values Are Printed Without Terminal Control-Sequence Sanitization
- Content
View full analysis
5} {s['pnl']:>+12.2f} {s['win_rate']:>6.1f}%") ``` ```python for tag in sorted(tags, key=lambda t: -tags[t]["pnl"]): t = tags[tag] print(f" {tag:<12} {t['trades']:>5} {t['pnl']:>+12.2f} {t['win_rate']:>6.1f}% {t['avg_pnl']:>+10.2f}") ``` ### Technical Analysis The `stock` and `tag` values originate from user-supplied CSV fields and are interpolated directly into terminal output. The application does not remove escape characters, carriage returns, newlines, C0/C1 control characters, or ANSI/OSC/CSI terminal sequences before printing these values. A malicious CSV can therefore contain terminal instructions in a stock name, symbol, strategy, or tag. When the report is displayed in a compatible terminal emulator, those sequences may alter colors, move the cursor, overwrite previously displayed text, create deceptive hyperlinks, clear parts of the screen, or trigger other emulator-specific behavior. The issue does not provide direct shell command execution through the Python application. Its practical effect depends on the terminal emulator and its enabled features. ### Attack Path 1. An attacker creates or modifies a trade CSV accepted by the application. 2. The attacker inserts terminal control sequences into a `stock`, `代码`, `symbol`, `name`, `tag`, `strategy`, or `策略` field. 3. A user invokes the tracker on that file. 4. The value is retained by `parse_trades()` and later printed by `print_analysis()` or `print_tag_analysis()`. 5. The user's terminal emulator interprets the embedded sequence rather than displaying it as ordinary text. 6. The attacker can consequently forge or obscure report content and potentially facilitate social-enginee ...[truncated 553 chars]- Remediation
View remediation