fix(security): use RestrictedUnpickler in load_instance (#2153)

* fix(security): enforce RestrictedUnpickler for load_instance to prevent unsafe pickle deserialization

* fix: lint error

qlib/contrib/data/dataset.py

@@ -11,7 +11,6 @@ from qlib.utils import init_instance_by_config
 
 from qlib.data.dataset import DatasetH
 
-
 device = "cuda" if torch.cuda.is_available() else "cpu"
 
 

qlib/contrib/evaluate.py

@@ -20,7 +20,6 @@ from ..data import D
 from ..config import C
 from ..data.dataset.utils import get_level_index
 
-
 logger = get_module_logger("Evaluate")
 
 

qlib/contrib/meta/__init__.py

@@ -3,5 +3,4 @@
 
 from .data_selection import MetaTaskDS, MetaDatasetDS, MetaModelDS
 
-
 __all__ = ["MetaTaskDS", "MetaDatasetDS", "MetaModelDS"]

qlib/contrib/meta/data_selection/__init__.py

@@ -4,5 +4,4 @@
 from .dataset import MetaDatasetDS, MetaTaskDS
 from .model import MetaModelDS
 
-
 __all__ = ["MetaDatasetDS", "MetaTaskDS", "MetaModelDS"]

qlib/contrib/model/pytorch_tabnet.py

@@ -317,7 +317,7 @@ class TabnetModel(Model):
             feature = x_train_values.float().to(self.device)
             label = y_train_values.float().to(self.device)
             priors = 1 - S_mask
-            (vec, sparse_loss) = self.tabnet_model(feature, priors)
+            vec, sparse_loss = self.tabnet_model(feature, priors)
             f = self.tabnet_decoder(vec)
             loss = self.pretrain_loss_fn(label, f, S_mask)
 
@@ -348,7 +348,7 @@ class TabnetModel(Model):
             S_mask = S_mask.to(self.device)
             priors = 1 - S_mask
             with torch.no_grad():
-                (vec, sparse_loss) = self.tabnet_model(feature, priors)
+                vec, sparse_loss = self.tabnet_model(feature, priors)
                 f = self.tabnet_decoder(vec)
 
                 loss = self.pretrain_loss_fn(label, f, S_mask)

qlib/contrib/online/utils.py

@@ -12,6 +12,7 @@ from ...data import D
 from ...config import C
 from ...log import get_module_logger
 from ...utils import get_next_trading_date
+from ...utils.pickle_utils import restricted_pickle_load
 from ...backtest.exchange import Exchange
 
 log = get_module_logger("utils")
@@ -30,7 +31,7 @@ def load_instance(file_path):
     if not file_path.exists():
         raise ValueError("Cannot find file {}".format(file_path))
     with file_path.open("rb") as fr:
-        instance = pickle.load(fr)
+        instance = restricted_pickle_load(fr)
     return instance
 
 

qlib/contrib/report/analysis_model/__init__.py

@@ -3,5 +3,4 @@
 
 from .analysis_model_performance import model_performance_graph
 
-
 __all__ = ["model_performance_graph"]

qlib/contrib/report/analysis_position/__init__.py

@@ -7,5 +7,4 @@ from .report import report_graph
 from .rank_label import rank_label_graph
 from .risk_analysis import risk_analysis_graph
 
-
 __all__ = ["cumulative_return_graph", "score_ic_graph", "report_graph", "rank_label_graph", "risk_analysis_graph"]

qlib/contrib/report/data/ana.py

@@ -12,6 +12,7 @@ Here is an example.
     fa.plot_all(wspace=0.3, sub_figsize=(12, 3), col_n=5)
 
 """
+
 import pandas as pd
 import numpy as np
 from qlib.contrib.report.data.base import FeaAnalyser

qlib/contrib/report/data/base.py

@@ -7,6 +7,7 @@ Assumptions
 - The analyse each feature individually
 
 """
+
 import pandas as pd
 from qlib.log import TimeInspector
 from qlib.contrib.report.utils import sub_fig_generator

qlib/contrib/strategy/__init__.py

@@ -16,7 +16,6 @@ from .rule_strategy import (
 
 from .cost_control import SoftTopkStrategy
 
-
 __all__ = [
     "TopkDropoutStrategy",
     "WeightStrategyBase",

qlib/contrib/strategy/optimizer/__init__.py

@@ -5,5 +5,4 @@ from .base import BaseOptimizer
 from .optimizer import PortfolioOptimizer
 from .enhanced_indexing import EnhancedIndexingOptimizer
 
-
 __all__ = ["BaseOptimizer", "PortfolioOptimizer", "EnhancedIndexingOptimizer"]

qlib/contrib/strategy/optimizer/enhanced_indexing.py

@@ -9,7 +9,6 @@ from typing import Union, Optional, Dict, Any, List
 from qlib.log import get_module_logger
 from .base import BaseOptimizer
 
-
 logger = get_module_logger("EnhancedIndexingOptimizer")
 
 

qlib/contrib/strategy/order_generator.py

@@ -4,6 +4,7 @@
 """
 This order generator is for strategies based on WeightStrategyBase
 """
+
 from ...backtest.position import Position
 from ...backtest.exchange import Exchange
 

qlib/contrib/torch.py

@@ -5,6 +5,7 @@ This module is not a necessary part of Qlib.
 They are just some tools for convenience
 It is should not imported into the core part of qlib
 """
+
 import torch
 import numpy as np
 import pandas as pd

qlib/contrib/tuner/launcher.py

@@ -13,7 +13,6 @@ import yaml
 
 from .config import TunerConfigManager
 
-
 args_parser = argparse.ArgumentParser(prog="tuner")
 args_parser.add_argument(
     "-c",

qlib/contrib/tuner/space.py

@@ -6,7 +6,6 @@
 
 from hyperopt import hp
 
-
 TopkAmountStrategySpace = {
     "topk": hp.choice("topk", [30, 35, 40]),
     "buffer_margin": hp.choice("buffer_margin", [200, 250, 300]),

qlib/contrib/workflow/__init__.py

@@ -3,5 +3,4 @@
 from .record_temp import MultiSegRecord
 from .record_temp import SignalMseRecord
 
-
 __all__ = ["MultiSegRecord", "SignalMseRecord"]