T09 · Insecure Skill Coding Practices
Warning
- Location
- scripts/fin_reg_calc.py:11
- Finding
- Invalid numeric inputs can produce false compliance approvals<![CDATA[ ## Vulnerability Details **File Location**: `scripts/fin_reg_calc.py`, lines 11–39 **Vulnerability Type**: T09: Insecure Skill Coding Practices **Risk Level**: Medium ### Vulnerable Code ```python def suitability(client_risk, product_risk): diff = product_risk - client_risk if diff <= 0: return "允许", True if diff == 1: return "限制(加签/告知)", True return "禁止(适当性不匹配)", False def threshold(amount): over = amount > LARGE_TX_THRESHOLD return ("超大额须报备" if over else "未超阈"), (not over) def main(): ap = argparse.ArgumentParser(description=NAME + " · 金融AI合规计算") ap.add_argument("--suitability", nargs=2, type=int, metavar=("CLIENT_RISK", "PRODUCT_RISK"), help="适当性: 客户风险等级 产品风险等级(1-5)") ap.add_argument("--threshold", type=float, help="大额上报阈值校验: 交易金额(元)") ap.add_argument("--json", action="store_true") a = ap.parse_args() if not a.suitability and a.threshold is None: print("用法: --suitability 客户风险 产品风险 | --threshold 金额", file=sys.stderr); sys.exit(2) out = {} ok = True if a.suitability: r, c = suitability(a.suitability[0], a.suitability[1]) out["suitability"] = {"client": a.suitability[0], "product": a.suitability[1], "result": r, "compliant": c} ok = ok and c if a.threshold is not None: r, c = threshold(a.threshold) out["threshold"] = {"amount": a.threshold, "result": r, "compliant": c} ok = ok and c ``` ### Technical Analysis The CLI documents client and product risk values as integers in the range 1 through 5, but `argparse` only verifies that they are integers. It does not enforce the documented range. Consequently, arbitrary negative or excessively large risk values participate directly in the subtraction used to determine suitability. The transaction amount is parsed as a Python `float` without checking that it is finite and non-negative. Python accepts special values such as `nan`. A comparison of `nan > 50000` evaluates to f ...[truncated 1710 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions 1. Enforce both client and product risk values as integers from 1 through 5. Invalid values should produce an explanatory error and exit code 2. 2. Parse monetary values with `decimal.Decimal` rather than binary floating-point. 3. Reject non-finite values, negative amounts, empty values, and values outside the supported business domain before performing compliance comparisons. 4. Define whether the threshold itself is inclusive. The current expression uses `amount > 50000`; confirm whether an amount exactly equal to 50,000 requires reporting and encode that rule explicitly. 5. Ensure invalid inputs never produce `compliant: true` or exit code 0. 6. Configure JSON serialization to reject non-standard values such as `NaN`, for example by using `allow_nan=False`. 7. Add regression tests for `NaN`, positive and negative infinity, negative amounts, zero, exact threshold values, and risk levels below 1 or above 5. ]]>