rules-pandas

pd.eval() / DataFrame.eval() executes an arbitrary expression string against the DataFrame. If the expression is built from user input, this is a code execution vulnerability. Use vectorised pandas operations or boolean indexing instead of eval() with dynamic strings.

Hardcoded database password in SQLAlchemy connection string or pandas DB call. Credentials in source files are exposed via git history and process listings. Use environment variables: create_engine(os.environ['DB_URL']) or a secrets manager.

pd.read_pickle() deserializes arbitrary Python objects using the pickle protocol — a critical RCE vector (CWE-502). A malicious .pkl file can execute arbitrary code on load. Use pd.read_parquet(), pd.read_csv(), or pd.read_feather() for safe serialization formats.

DataFrame.query() with string interpolation or concatenation. Building query strings from user input enables expression injection — query() uses a numexpr/pandas parser that can execute arbitrary Python. Use the @variable syntax to safely pass values: df.query('col == @value').

pd.read_sql() with a dynamically constructed query string is vulnerable to SQL injection (CWE-89). Pass parameters via the 'params' argument rather than string interpolation: pd.read_sql('SELECT * FROM t WHERE id = %s', conn, params=[user_id]).

pandas.Panel was removed in pandas 1.0 (deprecated since 0.25). Replace with a MultiIndex DataFrame or xarray.DataArray.

pd.read_clipboard() reads from the system clipboard — a non-reproducible, environment-dependent data source unsuitable for any code that runs in CI or production. Replace with pd.read_csv() from a checked-in fixture file.