T09 · Insecure Skill Coding Practices
Warning
- Location
scripts/ev_calculator.py:56- Finding
Missing Numeric Input Validation Can Produce Unsafe Financial Recommendations
- Content
View full analysis
float: return p * win - (1 - p) * loss def polymarket_ev(your_prob: float, market_price: float) -> Tuple[float, float]: edge = your_prob - market_price ev_dollar = edge / market_price if market_price > 0 else 0 return edge, ev_dollar def kelly_from_ev(p: float, b: float, fraction: float = 0.5) -> float: f_star = (p * b - (1 - p)) / b if f_star < 0: return 0 return f_star * fraction ``` ```python parser.add_argument("--p", type=float, help="胜率 (0-1, e.g., 0.55)") parser.add_argument("--win", type=float, help="赢的金额 (e.g., 1.10)") parser.add_argument("--loss", type=float, help="输的金额 (e.g., 1.00)") parser.add_argument("--market", type=float, help="市场定价 (Polymarket, 0-1)") parser.add_argument("--your", type=float, help="你的判断概率 (0-1)") parser.add_argument("--b", type=float, help="盈亏比 (win/loss)") parser.add_argument("--json", action="store_true", help="JSON输出") args = parser.parse_args() result = {} if args.p is not None and args.win is not None and args.loss is not None: ev = calculate_ev(args.p, args.win, args.loss) ev_pct = (ev / args.loss * 100) if args.loss > 0 else 0 ``` ### Technical Analysis The command-line parser converts values to floating-point numbers but does not enforce their semantic domains. Probabilities and market prices are expected to be within `[0, 1]`; win and loss amounts should be non-negative or positive as appropriate; and the Kelly payoff ratio must be greater than zero. The code also does not reject non-finite IEEE-754 values such as `NaN` and positive or negative infinity. Consequently, the calculator accepts inputs that do not represent valid probabilities or financial values. For example, `--p nan` propagates `NaN` through ...[truncated 1732 chars]- Remediation
View remediation
= 0` and `loss > 0`. - Require `b > 0`. - Define and enforce an allowed range for the fractional Kelly coefficient. 2. Reject `NaN` and infinite values with `math.isfinite()`. 3. Return a nonzero exit status and a clear error message for invalid or incomplete argument combinations. 4. Prevent non-standard JSON output by using `json.dumps(..., allow_nan=False)`. 5. Add unit tests for boundary values, negative values, zero denominators, `NaN`, infinity, and probabilities outside `[0, 1]`. Example validation helper: ```python import math def probability(value: float, name: str) -> float: if not math.isfinite(value) or not 0 <= value <= 1: raise ValueError(f"{name} must be a finite value between 0 and 1") return value def positive(value: float, name: str) -> float: if not math.isfinite(value) or value <= 0: raise ValueError(f"{name} must be a finite value greater than zero") return value ``` ]]>