Skip to content

Issue 1: Unvalidated User Input for ARIMA Parameters #11

@PrinceSajjadHussain

Description

@PrinceSajjadHussain

Title: ARIMA Parameters Vulnerable to Injection and Errors

Body:
The code takes the ARIMA parameters (p, d, q) directly from user input using input().split() and maps them to integers. This presents several problems:

  1. Error Handling: If the user enters non-numeric input, the int() conversion will raise a ValueError, crashing the program.
  2. Input Validation: There is no validation to ensure that the entered parameters are sensible for ARIMA modeling. For example, negative values or excessively large values could lead to unexpected behavior or errors within the ARIMA model fitting process.
  3. Potential Injection: While less likely in this specific scenario, directly using user input in numerical calculations is generally a bad practice. A malicious user could potentially craft input that exploits vulnerabilities in the underlying numerical libraries (though this is highly improbable with statsmodels).

Recommendation:

  1. Implement robust error handling using a try-except block around the input() and map() operations to gracefully handle ValueError exceptions.
  2. Add input validation to ensure that p, d, and q are non-negative integers within reasonable bounds (e.g., based on the length of the training data).
  3. Consider using a more structured way to get the parameters, such as a configuration file or command-line arguments with type checking.

Metadata

Metadata

Assignees

No one assigned

    Labels

    No labels
    No labels

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions