fix: isolate untrusted strategy execution

Author: Henry

SECURITY.md

@@ -93,6 +93,29 @@ in release notes or documentation, if desired.
 
 ---
 
+## Security Advisories
+
+### August 2026 — Strategy and indicator execution isolation
+
+Deployments that accepted untrusted strategy or indicator code before the
+August 2026 hardening update should assume application environment secrets may
+have been exposed. Upgrade to the latest `main` revision, review access logs,
+and rotate JWT/session secrets, database credentials, provider tokens, and
+connected broker or exchange credentials. Preserve access to credentials
+encrypted with the previous `CREDENTIAL_ENCRYPTION_KEY` until they have been
+re-encrypted or re-entered; changing that key without a migration makes stored
+credentials unreadable.
+
+## Security Acknowledgments
+
+- **Satrio**, independent security researcher — responsibly disclosed a
+  critical runtime-built attribute-traversal issue in the strategy and
+  indicator execution boundary in August 2026. The research was performed
+  against the public repository only and did not access the hosted service or
+  real user data.
+
+---
+
 ## ⚠️ Disclaimer
 
 QuantDinger is provided **as-is**, without warranty.

backend_api_python/app/services/indicator_signal_alerts.py

@@ -26,7 +26,7 @@
 from app.utils.db import get_db_connection
 from app.utils.logger import get_logger
 from app.utils.notification_display import with_display
-from app.utils.safe_exec import build_safe_builtins, safe_exec_with_validation
+from app.utils.safe_exec import safe_exec_indicator_isolated
 
 
 logger = get_logger(__name__)
@@ -669,32 +669,16 @@ def _bars_to_df(self, bars: Iterable[Dict[str, Any]]) -> pd.DataFrame:
         return df
 
     def _execute_indicator(self, code: str, df: pd.DataFrame, params: Dict[str, Any]) -> Dict[str, Any]:
-        exec_env = {
-            "__builtins__": build_safe_builtins(),
-            "df": df.copy(),
-            "pd": pd,
-            "np": np,
-            "math": math,
-            "params": params or {},
-            "output": None,
-        }
-        # Use one namespace, matching the chart/validation execution path.
-        # Indicator helpers such as `def safe_div(...)` must be visible to
-        # later code and nested functions during scheduled alert checks.
-        for col in ("open", "high", "low", "close", "volume"):
-            if col in exec_env["df"].columns:
-                exec_env[col] = exec_env["df"][col]
-
-        result = safe_exec_with_validation(
+        result = safe_exec_indicator_isolated(
             code=code,
-            exec_globals=exec_env,
-            exec_locals=exec_env,
+            df=df,
+            params=params,
             timeout=20,
         )
         if not result.get("success"):
             raise RuntimeError(result.get("error") or "Indicator execution failed")
 
-        output = exec_env.get("output")
+        output = (result.get("result") or {}).get("output")
         if not isinstance(output, dict):
             raise ValueError("Indicator output must be a dict")
         return output

backend_api_python/app/services/indicator_validation.py

@@ -6,7 +6,7 @@
 
 from app.services.indicator_code_quality import analyze_indicator_code_quality
 from app.services.indicator_params import IndicatorParamsParser
-from app.utils.safe_exec import build_safe_builtins, safe_exec_with_validation
+from app.utils.safe_exec import safe_exec_indicator_isolated
 
 
 def generate_mock_df(length: int = 200) -> pd.DataFrame:
@@ -55,22 +55,10 @@ def validate_indicator_code(code: str, user_params: Dict[str, Any] | None = None
     hints = analyze_indicator_code_quality(raw)
     df = generate_mock_df()
     merged_params = merge_indicator_params(raw, user_params)
-    exec_env = {
-        "df": df.copy(),
-        "pd": pd,
-        "np": np,
-        "params": merged_params,
-        "output": None,
-    }
-    # OHLCV series are available as convenience globals in addition to df columns.
-    for col in ("open", "high", "low", "close", "volume"):
-        exec_env[col] = exec_env["df"][col]
-    exec_env["__builtins__"] = build_safe_builtins()
-
-    exec_result = safe_exec_with_validation(
+    exec_result = safe_exec_indicator_isolated(
         code=raw,
-        exec_globals=exec_env,
-        exec_locals=exec_env,
+        df=df,
+        params=merged_params,
         timeout=20,
     )
     if not exec_result.get("success"):
@@ -86,7 +74,7 @@ def validate_indicator_code(code: str, user_params: Dict[str, Any] | None = None
             "hints": hints,
         }
 
-    output = exec_env.get("output")
+    output = (exec_result.get("result") or {}).get("output")
     if output is None:
         return {
             "success": False,