nautilus_trader
nautilus_trader copied to clipboard
Fix dangerous code execution function that could allow external attacks in nautilus_trader/backtest/config.py
Context and Purpose:
This PR automatically remediates a security vulnerability:
- Description: Detected the use of eval(). eval() can be dangerous if used to evaluate dynamic content. If this content can be input from outside the program, this may be a code injection vulnerability. Ensure evaluated content is not definable by external sources.
- Rule ID: python.lang.security.audit.eval-detected.eval-detected
- Severity: HIGH
- File: nautilus_trader/backtest/config.py
- Lines Affected: 72 - 72
This change is necessary to protect the application from potential security risks associated with this vulnerability.
Solution Implemented:
The automated remediation process has applied the necessary changes to the affected code in nautilus_trader/backtest/config.py to resolve the identified issue.
Please review the changes to ensure they are correct and integrate as expected.
Thank you for your submission! We really appreciate it. Like many open source projects, we ask that you sign our Contributor License Agreement before we can accept your contribution.
You have signed the CLA already but the status is still pending? Let us recheck it.
Hi @anupamme
LLM quick verdict:
Do not merge as-is. The patch doesn’t plant any back-doors, but it breaks the code and still doesn’t achieve the stated security goal of eliminating eval.
Hi @anupamme
This is now addressed from https://github.com/nautechsystems/nautilus_trader/commit/56c8fcba66aa2bef6c430b143e658232a5327654. Many thanks again for the reminder on this one :pray:.