T09 · Insecure Skill Coding Practices
Error
- Location
- scripts/build_trade_checklist.py:48
- Finding
- Non-Finite Numeric Values Bypass Live-Trade Safety Validation<![CDATA[ ## Vulnerability Details **File Location**: `scripts/build_trade_checklist.py:48-64, 110-130` **Vulnerability Type**: Improper numeric input validation / fail-open safety checks **Risk Level**: High ### Vulnerable Code ```python def validate_price(value: str) -> float: number = float(value) if number <= 0: raise argparse.ArgumentTypeError("Price must be greater than zero.") return number def validate_non_negative_float(value: str) -> float: number = float(value) if number < 0: raise argparse.ArgumentTypeError("Value must be zero or greater.") return number ``` ```python if args.environment == "live": if args.risk_cap_usd is None: parser.error("--risk-cap-usd is required for live trading mode") if args.data_age_seconds is None: parser.error("--data-age-seconds is required for live trading mode") if args.data_age_seconds > args.max_data_age_seconds: parser.error( f"data is stale ({args.data_age_seconds}s > {args.max_data_age_seconds}s)" ) if args.order_type == "market" and not args.allow_market_order_live: parser.error( "live market orders are blocked by default; pass --allow-market-order-live " "to override explicitly" ) if ( args.observed_price_drift_pct is not None and args.observed_price_drift_pct > args.max_price_drift_pct ): parser.error( "observed price drift exceeds configured maximum " f"({args.observed_price_drift_pct}% > {args.max_price_drift_pct}%)" ) ``` ### Technical Analysis Python's `float()` accepts special IEEE-754 values such as `nan`, `inf`, and `-inf`. The validators only use ordinary comparisons and do not verify that the parsed value is finite. In particular, comparisons involving `NaN` are false: ```python float("nan") <= 0 # False float("nan") < 0 # False float("nan") > 1.0 # False ``` Consequently, `n ...[truncated 1706 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions 1. Reject every non-finite floating-point value immediately after parsing: ```python import math def validate_price(value: str) -> float: try: number = float(value) except ValueError as exc: raise argparse.ArgumentTypeError("Price must be numeric.") from exc if not math.isfinite(number) or number <= 0: raise argparse.ArgumentTypeError( "Price must be a finite number greater than zero." ) return number ``` 2. Apply `math.isfinite()` to all floating-point validators, including non-negative percentages and thresholds. 3. Consider using `decimal.Decimal` for financial values to avoid binary floating-point behavior. 4. Generate strict JSON with: ```python json.dumps(payload, indent=2, allow_nan=False) ``` 5. Add automated tests covering `nan`, `NaN`, `inf`, `-inf`, overflow values, negative values, and zero. 6. Treat serialization failure as a blocked checklist rather than replacing invalid data silently. ]]>