Kronos (shiyu-coder/Kronos)

Issue 1 (CRITICAL): Path traversal in web API lets attackers read arbitrary files

In webui/app.py lines 142-178, the /api/load-data and /api/predict endpoints accept a file_path parameter directly from user POST data with no validation. The load_data_file() function opens whatever path the user provides.

An attacker can read arbitrary .csv or .feather files from the server by sending paths like ../../etc/passwd. Combined with no authentication and Flask debug mode, this is a serious vulnerability.

Suggested fix: Restrict file paths to a designated data directory and validate that resolved paths start with the allowed base directory.

Issue 2 (CRITICAL): Flask debug mode enabled allows remote code execution

In webui/app.py:725 and webui/run.py:71, the Flask app runs with debug=True. This enables the Werkzeug interactive debugger. Anyone who triggers an exception can access /console and execute arbitrary Python code on the server.

Suggested fix: Set debug=False in production and use an env variable to toggle it in dev.

Issue 3 (CRITICAL): Insecure pickle deserialization in finetuning pipeline

In finetune/dataset.py:39 and finetune/qlib_test.py:220,247, pickle.load() is called on data files with no integrity check. Pickle is inherently unsafe - malicious pickle data can execute arbitrary code during deserialization. Issue #216 already flags this.

Suggested fix: Use safetensors (already a dependency) instead of pickle, or add HMAC signing/verification before loading.

Issue 4 (HIGH): Web UI has no authentication or CSRF protection

The web UI at webui/app.py has zero authentication. Flask-CORS is enabled with default permissive settings. Anyone who can reach the server can load models, scan the filesystem, and run predictions.

Suggested fix: Add authentication (Flask-Login or JWT), restrict CORS origins, add CSRF protection, and rate-limit prediction endpoints.

Issue 5 (HIGH): Prediction results saved as plaintext JSON without access control

In webui/app.py lines 173-230, financial prediction results including full OHLCV time series are saved to webui/prediction_results/ as plaintext JSON files. These contain potentially sensitive market data and prediction signals.

Suggested fix: Encrypt saved prediction files, restrict file permissions to 0o600, and add automatic cleanup for old results.

PR: Fix path traversal and add input validation in web API

This PR addresses Issues 1 and 4 above by:

1. Adding a DATA_DIR constant that restricts file loading to a specific directory
2. Validating that resolved absolute paths start with DATA_DIR before opening files
3. Disabling Flask debug mode by default
4. Adding basic rate limiting on prediction endpoints

The web API should never trust user-supplied file paths. This fix ensures that even if an attacker reaches the API endpoints, they cannot traverse outside the designated data directory.