Comments (4)
Changed the title since technically speaking it's not "external" data, since you are in control of the entire project which includes both code and Pickle files.
But I'm concerned simply because there's no need to risk RCE everytime people want to query the data.
from financedatabase.
So I don't entirely see the issue here. As you say I am in full control of the database but I am also affiliated directly with OpenBB. There are no incentives for me whatsoever to include malicious code.
Furthermore, the database is setup in such a way that in no circumstances I would accept a PR that changes the pickles, that's what I have GitHub Actions for. You would need to add the malicious code directly into the CSV file for it to work and have it activate only if you read a pickle and not a CSV. Let alone that I shouldn't be able to notice, it doesn't affect my local repository, file sizes do not change whatsoever and all functionality still works exactly the same.
Lots of steps you need to take to achieve such a feat and therefore I don't really see the risk or major security issue. Especially since there has been no PR to improve the database in 3 years time.
In any case I'll convert to the next best thing, being compressed CSVs to eliminate the risk altogether.
from financedatabase.
Fixed with new release.
from financedatabase.
Thank you very much for the quick answer and your fix!
There are no incentives for me whatsoever to include malicious code.
Indeed! My concern was rather: What if a reviewer overlooks a malicious PR? What if your account gets compromised? What if GitHub or an Actions runner gets compromised? I understand chances of this are very low, but the impact of 100,000's of users dynamically downloading files that can run arbitrary code without a sandbox was nightmare material for me.
Thanks a lot for taking care of this. ❤️
from financedatabase.
Related Issues (20)
- [BUG] No required/depends clauses in setup.py/pyproject.toml HOT 3
- [DATA] - Added Kenya Agriculturals HOT 1
- [DATA]root directory database has case sensitive conflict with "FinanceDatabase/financedatabase/helpers.py"
- Failed downloads HOT 4
- [IMPROVE] remove accented characters from name column HOT 2
- Can I get the Sec fillings from this database? HOT 1
- [FR] Multiple criteria while searching HOT 2
- [IMPROVE] The 'pathlib' module is used but it doesn't appear in the dependencies section in pyproject.toml HOT 2
- IndexError in technical analysis of biotech ETFs during coronacrisis sample HOT 2
- Typo error in contributing file
- TYPO ERROR
- [TYPO] in https://github.com/JerBouma/FinanceDatabase/blob/main/compression/README.md?plain=1
- Typo Error In Readme File
- [DATA] Added MBG.DE and DTG.DE HOT 1
- [DATA] Fixed data for FFH.TO HOT 4
- [FR] List of ETFs and stocks HOT 2
- Support for option chain data HOT 1
- [DATA] How can we contribute ISIN codes ? HOT 2
- [DATA] How can we contribute ISIN codes ?
Recommend Projects
-
React
A declarative, efficient, and flexible JavaScript library for building user interfaces.
-
Vue.js
🖖 Vue.js is a progressive, incrementally-adoptable JavaScript framework for building UI on the web.
-
Typescript
TypeScript is a superset of JavaScript that compiles to clean JavaScript output.
-
TensorFlow
An Open Source Machine Learning Framework for Everyone
-
Django
The Web framework for perfectionists with deadlines.
-
Laravel
A PHP framework for web artisans
-
D3
Bring data to life with SVG, Canvas and HTML. 📊📈🎉
-
Recommend Topics
-
javascript
JavaScript (JS) is a lightweight interpreted programming language with first-class functions.
-
web
Some thing interesting about web. New door for the world.
-
server
A server is a program made to process requests and deliver data to clients.
-
Machine learning
Machine learning is a way of modeling and interpreting data that allows a piece of software to respond intelligently.
-
Visualization
Some thing interesting about visualization, use data art
-
Game
Some thing interesting about game, make everyone happy.
Recommend Org
-
Facebook
We are working to build community through open source technology. NB: members must have two-factor auth.
-
Microsoft
Open source projects and samples from Microsoft.
-
Google
Google ❤️ Open Source for everyone.
-
Alibaba
Alibaba Open Source for everyone
-
D3
Data-Driven Documents codes.
-
Tencent
China tencent open source team.
from financedatabase.