nautilus_trader icon indicating copy to clipboard operation
nautilus_trader copied to clipboard

Fix dangerous code execution function that could allow external attacks in nautilus_trader/backtest/config.py

Open anupamme opened this issue 5 months ago • 2 comments

Context and Purpose:

This PR automatically remediates a security vulnerability:

  • Description: Detected the use of eval(). eval() can be dangerous if used to evaluate dynamic content. If this content can be input from outside the program, this may be a code injection vulnerability. Ensure evaluated content is not definable by external sources.
  • Rule ID: python.lang.security.audit.eval-detected.eval-detected
  • Severity: HIGH
  • File: nautilus_trader/backtest/config.py
  • Lines Affected: 72 - 72

This change is necessary to protect the application from potential security risks associated with this vulnerability.

Solution Implemented:

The automated remediation process has applied the necessary changes to the affected code in nautilus_trader/backtest/config.py to resolve the identified issue.

Please review the changes to ensure they are correct and integrate as expected.

anupamme avatar Jun 09 '25 02:06 anupamme

CLA assistant check
Thank you for your submission! We really appreciate it. Like many open source projects, we ask that you sign our Contributor License Agreement before we can accept your contribution.
You have signed the CLA already but the status is still pending? Let us recheck it.

CLAassistant avatar Jun 09 '25 02:06 CLAassistant

Hi @anupamme

LLM quick verdict:

Do not merge as-is. The patch doesn’t plant any back-doors, but it breaks the code and still doesn’t achieve the stated security goal of eliminating eval.

cjdsellers avatar Jun 09 '25 02:06 cjdsellers

Hi @anupamme

This is now addressed from https://github.com/nautechsystems/nautilus_trader/commit/56c8fcba66aa2bef6c430b143e658232a5327654. Many thanks again for the reminder on this one :pray:.

cjdsellers avatar Jun 10 '25 02:06 cjdsellers