Skip to content

Potential fix for code scanning alert no. 254: Code injection #55

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
brokermr810 merged 2 commits into from
Apr 22, 2026
Merged

Potential fix for code scanning alert no. 254: Code injection #55

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
fe105d1
Potential fix for code scanning alert no. 254: Code injection
brokermr810 Apr 22, 2026
ecce15b
Potential fix for pull request finding 'CodeQL / Information exposure…
brokermr810 Apr 22, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
8 changes: 8 additions & 0 deletions backend_api_python/app/routes/backtest.py
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -13,6 +13,7 @@
from app.utils.logger import get_logger
from app.utils.db import get_db_connection
from app.utils.auth import login_required
from app.utils.safe_exec import validate_code_safety
import requests

logger = get_logger(__name__)
Expand Down Expand Up @@ -174,6 +175,13 @@ def run_backtest():
# Extract params - use current user's ID
user_id = g.user_id
indicator_code = data.get('indicatorCode', '')
is_safe_code, unsafe_reason = validate_code_safety(indicator_code or '')
if not is_safe_code:
return jsonify({
'code': 0,
'msg': f'Unsafe indicator code: {unsafe_reason}',
'data': None
}), 400
Comment thread
github-advanced-security[bot] marked this conversation as resolved.
Fixed
indicator_id = data.get('indicatorId')
symbol = data.get('symbol', '')
market = data.get('market', '')
Expand Down
7 changes: 4 additions & 3 deletions backend_api_python/app/utils/safe_exec.py
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -411,11 +411,12 @@ def validate_code_safety(code: str) -> Tuple[bool, Optional[str]]:
try:
tree = ast.parse(code)
except SyntaxError as e:
return False, f"代码语法错误: {e}"
logger.warning(f"Code syntax validation failed: {e}")
return False, "代码语法错误"
except Exception as e:
# AST parse failure → reject (fail-closed, not fail-open)
logger.error(f"AST parse failed, rejecting code: {e}")
return False, f"代码解析失败: {e}"
logger.exception("AST parse failed, rejecting code")
return False, "代码解析失败"

dangerous_modules = {
'os', 'sys', 'subprocess', 'shutil', 'signal', 'resource',
Expand Down
Loading