T09 · Insecure Skill Coding Practices
Warning
- Location
scripts/trading_log.py:41- Finding
Insufficient transaction validation permits persistent financial-record corruption
- Content
View full analysis
0 else 0 pos["direction"] = "买入" elif direction == "卖出": pnl = (float(price) - pos["avg_cost"]) * float(quantity) pos["realized_pnl"] += pnl pos["shares"] -= float(quantity) pos["sell_record"].append({ "date": today, "price": float(price), "quantity": float(quantity), "pnl": pnl }) if pos["shares"] <= 0: pos["shares"] = 0 pos["avg_cost"] = 0 pos["direction"] = "已清仓" else: pos["direction"] = "买入" ``` The command-line validation only checks whether the parsed values are numerically zero: ```python if cmd == '买入': code = args[1].zfill(6) if len(args) > 1 else '' price = float(args[2]) if len(args) > 2 else 0 quantity = float(args[3]) if len(args) > 3 else 0 reason = args ...[truncated 4672 chars]- Remediation
View remediation