T09 · Insecure Skill Coding Practices
- Location
scripts/compliance-scanner.py:422- Finding
Unsupported countries fail open during sanctions and embargo assessment
- Content
View full analysis
Vulnerability Details
File Location:
scripts/compliance-scanner.py, lines 422-484
Vulnerability Type: Fail-open input validation and unsafe compliance defaults
Risk Level: HighComplete Code Snippet
python def _evaluate_sanctions_risk(country: str) -> Dict: """评估制裁风险""" country_info = COUNTRY_DATA.get(country, {}) sanctions = country_info.get("sanctions", "无") if "广泛" in sanctions or "严格" in sanctions: level = "极高" score = 100 elif "部分" in sanctions or "独立" in sanctions: level = "中" score = 50 else: level = "低" score = 20 return { "dimension": "制裁", "level": level, "score": score, "details": [ f"目标市场: {country}", f"制裁情况: {sanctions}" ], "recommendations": _get_sanctions_recommendations(level) } def _get_sanctions_recommendations(level: str) -> List[str]: """获取制裁建议""" if level == "极高": return [ "建议暂缓该市场业务", "如确需开展，建议进行专业法律评估", "考虑通过第三方合规渠道" ] elif level == "中": return [ "建议定期关注制裁名单更新", "保持与专业合规机构的咨询", "确保交易对手不在制裁名单" ] else: return ["制裁风险较低，保持常规合规即可"] def _evaluate_embargo_risk(country: str) -> Dict: """评估禁运风险""" country_info = COUNTRY_DATA.get(country, {}) is_embargo = country_info.get("embargo", False) if is_embargo: level = "极高" score = 100 else: level = "低" score = 10 return { "dimension": "禁运", "level": level, "score": score, "details": [ f"目标市场: {country}", f"禁运状态: {'是' if is_embargo else '否'}" ], "recommendations": ["该市场可正常开展贸易业务"] if not is_embargo else ["建议避免该市场业务"] }Technical Analysis
The scanner retrieves country information with
COUNTRY_DATA.get(country, {}). When a country is unsupporte ...[truncated 2744 chars]- Remediation
View remediation
Remediation Suggestions
- Reject unsupported countries before calculating any risk score:
python def require_country(country: str) -> Dict: normalized = normalize_country(country) if normalized not in COUNTRY_DATA: raise ValueError( f"No compliance data is available for country: {country}" ) return COUNTRY_DATA[normalized]- Replace safe defaults with explicit unknown states. Missing sanctions or embargo information should produce:
json { "level": "REVIEW_REQUIRED", "score": null, "status": "UNKNOWN", "recommendations": [ "Do not proceed until the jurisdiction is verified against current authoritative sources." ] }-
Normalize input before lookup:
- Trim leading and trailing whitespace.
- Apply consistent case handling.
- Support reviewed country aliases and ISO 3166 codes.
- Reject ambiguous names rather than guessing.
-
Apply the same country validation to
scan,country-risk, andreportso all entry points have consistent behavior. -
Do not calculate an overall score when a mandatory dimension is unknown. Propagate
REVIEW_REQUIREDto the final result. -
Use current authoritative sanctions and embargo sources instead of treating static bundled data as conclusive. Include the source, retrieval time, list version, and freshness status in every result.
-
Add automated tests for:
- Unsupported countries.
- Misspellings.
- Alternate country names.
- Leading and trailing whitespace.
- Empty country values.
- Missing sanctions or embargo fields.
- Stale source data.
-
Clearly state in generated reports that the static scanner is an estimator and cannot establish legal clearance.