Fix: Harden Python client runtime correctness, bounded I/O, and secret hygiene - #136
Open
mertcano wants to merge 2 commits into
Open
Fix: Harden Python client runtime correctness, bounded I/O, and secret hygiene#136mertcano wants to merge 2 commits into
mertcano wants to merge 2 commits into
Conversation
…t hygiene
### Description
This PR addresses runtime correctness, unbound network I/O, and secret hygiene vulnerabilities within the `kalshi-starter-code-python` repository, as identified in the workspace-wide security audit.
**Vulnerabilities & Security Defects Remediated:**
* **Python Runtime Correctness & Import Safety (`main.py`):** Explicitly imported missing required modules (`os`, `asyncio`). The execution entry point is now safely protected by `if __name__ == "__main__":` to prevent accidental execution or HTTP calls upon module import.
* **Bounded Network I/O & Mutable Defaults (`clients.py`):** API requests previously lacked timeouts and utilized mutable default dictionaries (`params={}`). The HTTP client now reuses a `requests.Session()`, enforces a strict 10-second `REQUEST_TIMEOUT_SECONDS`, and accepts immutable `Optional[Mapping]`. Rate limiting has been migrated to `time.monotonic()` for reliability, and `finally` blocks guarantee determinist connection cleanup.
* **Credential and Private-Key Handling (`main.py`, `.gitignore`, `requirements.txt`):** The configuration logic is now fully environment-driven and actively validated. RSA private keys are loaded safely without printing sensitive material, and encrypted PEM passwords are now officially supported. `.pem` and `.key` artifacts are actively ignored by `.gitignore`. The undocumented reliance on `requests` has been resolved by explicitly pinning it in `requirements.txt`.
Added patterns to ignore Python cache files and private keys.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Description
This PR addresses runtime correctness, unbound network I/O, and secret hygiene vulnerabilities within the
kalshi-starter-code-pythonrepository, as identified in the workspace-wide security audit.Vulnerabilities & Security Defects Remediated:
main.py): Explicitly imported missing required modules (os,asyncio). The execution entry point is now safely protected byif __name__ == "__main__":to prevent accidental execution or HTTP calls upon module import.clients.py): API requests previously lacked timeouts and utilized mutable default dictionaries (params={}). The HTTP client now reuses arequests.Session(), enforces a strict 10-secondREQUEST_TIMEOUT_SECONDS, and accepts immutableOptional[Mapping]. Rate limiting has been migrated totime.monotonic()for reliability, andfinallyblocks guarantee determinist connection cleanup.main.py,.gitignore,requirements.txt): The configuration logic is now fully environment-driven and actively validated. RSA private keys are loaded safely without printing sensitive material, and encrypted PEM passwords are now officially supported..pemand.keyartifacts are actively ignored by.gitignore. The undocumented reliance onrequestshas been resolved by explicitly pinning it inrequirements.txt.