Skip to content

Conversation

anupamme
Copy link

Context and Purpose:

This PR automatically remediates a security vulnerability:

  • Description: Detected the use of eval(). eval() can be dangerous if used to evaluate dynamic content. If this content can be input from outside the program, this may be a code injection vulnerability. Ensure evaluated content is not definable by external sources.
  • Rule ID: python.lang.security.audit.eval-detected.eval-detected
  • Severity: HIGH
  • File: examples/benchmarks/TRA/src/model.py
  • Lines Affected: 54 - 54

This change is necessary to protect the application from potential security risks associated with this vulnerability.

Solution Implemented:

The automated remediation process has applied the necessary changes to the affected code in examples/benchmarks/TRA/src/model.py to resolve the identified issue.

Please review the changes to ensure they are correct and integrate as expected.

@github-actions github-actions bot added the waiting for triage Cannot auto-triage, wait for triage. label May 30, 2025
@SunsetWolf
Copy link
Collaborator

Hi, @anupamme
Thank you for your contribution to qlib. Running the code based on your changes results in: It doesn't work because.

ast.literal_eval can only handle literals: numbers, strings, lists, dictionaries, tuples.

But model_type is “LSTM” (or similar model class name), which is a name node (ast.Name) in AST, not a literal.

Can you fix this issue?

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
waiting for triage Cannot auto-triage, wait for triage.
Projects
None yet
Development

Successfully merging this pull request may close these issues.

2 participants