saymrwulf/prophet
1
0
Fork 0
mirror of https://github.com/saymrwulf/prophet.git synced 2026-07-28 20:11:27 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions

Fixing potential security issue (#2108)

Browse source 
An attacker could access random URL from the executing server if model is crafted. It happens
because pd.read_json checks if the parameter is string contains URL and loads it in the case. The
fix enforcing using parameter as a JSON.

Co-authored-by: Alex Barouski <barouski@fb.com>
This commit is contained in:
Aliaksandr Barouski 2022-01-31 11:18:56 -08:00 committed by GitHub
parent ed0dc7a3fd
commit efca9301ce
No known key found for this signature in database
GPG key ID: 4AEE18F83AFDEB23
1 changed files with 3 additions and 2 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

5
python/prophet/serialize.py
View file

@ -8,6 +8,7 @@ from __future__ import absolute_import, division, print_function
from collections import OrderedDict
from copy import deepcopy
from io import StringIO
import json
import numpy as np
@ -145,7 +146,7 @@ def model_from_dict(model_dict):
if model_dict[attribute] is None:
setattr(model, attribute, None)
else:
s = pd.read_json(model_dict[attribute], typ='series', orient='split')
s = pd.read_json(StringIO(model_dict[attribute]), typ='series', orient='split')
if s.name == 'ds':
if len(s) == 0:
s = pd.to_datetime(s)
@ -159,7 +160,7 @@ def model_from_dict(model_dict):
if model_dict[attribute] is None:
setattr(model, attribute, None)
else:
df = pd.read_json(model_dict[attribute], typ='frame', orient='table', convert_dates=['ds'])
df = pd.read_json(StringIO(model_dict[attribute]), typ='frame', orient='table', convert_dates=['ds'])
if attribute == 'train_component_cols':
# Special handling because of named index column
df.columns.name = 'component'