Skip to content

fix(security): 2 improvements across 2 files#1189

Open
tomaioo wants to merge 2 commits into
Nixtla:mainfrom
tomaioo:fix/security/hardcoded-absolute-paths-expose-internal
Open

fix(security): 2 improvements across 2 files#1189
tomaioo wants to merge 2 commits into
Nixtla:mainfrom
tomaioo:fix/security/hardcoded-absolute-paths-expose-internal

Conversation

@tomaioo

@tomaioo tomaioo commented Jul 16, 2026

Copy link
Copy Markdown

Summary

fix(security): 2 improvements across 2 files

Problem

Severity: Medium | File: experiments/ets_intervals/src/evaluation.py:L19

The evaluation scripts contain hardcoded absolute paths pointing to a specific user's home directory (/home/ubuntu/statsforecast/...). This indicates that the code was committed without sanitizing local configurations. This breaks portability, leaks internal infrastructure details, and can cause unexpected runtime failures if the path is manipulated or expected to exist in deployment.

Solution

Remove hardcoded absolute paths. Use relative paths, environment variables, or CLI arguments to determine the data directory dynamically.

Changes

  • experiments/ets_intervals/src/evaluation.py (modified)
  • experiments/ces_intervals/src/evaluation.py (modified)

tomaioo added 2 commits July 16, 2026 13:09
- Security: Hardcoded Absolute Paths Expose Internal Directory Structure
- Security: Hardcoded Absolute Paths Expose Internal Directory Structure

Signed-off-by: tomaioo <203048277+tomaioo@users.noreply.github.com>
- Security: Hardcoded Absolute Paths Expose Internal Directory Structure
- Security: Hardcoded Absolute Paths Expose Internal Directory Structure

Signed-off-by: tomaioo <203048277+tomaioo@users.noreply.github.com>
@CLAassistant

Copy link
Copy Markdown

CLA assistant check
Thank you for your submission! We really appreciate it. Like many open source projects, we ask that you sign our Contributor License Agreement before we can accept your contribution.
You have signed the CLA already but the status is still pending? Let us recheck it.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants