fix(security): 2 improvements across 2 files

[tomaioo]

Summary

fix(security): 2 improvements across 2 files

Problem

Severity: Critical | File: src/akkudoktoreos/prediction/interpolator.py:L20

The SelfConsumptionProbabilityInterpolator class uses pickle.load() to deserialize data from a file without any validation or sanitization. Pickle is a dangerous serialization format that can execute arbitrary code during deserialization. An attacker who can modify or replace the .pkl file (regular_grid_interpolator.pkl) can achieve remote code execution when the application loads this file. The code even includes a # noqa: S301 comment acknowledging the security issue but suppresses it rather than fixing it.

Solution

Replace pickle with a safer serialization format like JSON, or if binary format is required, use a format with schema validation like Protocol Buffers, FlatBuffers, or numpy's native save/load with explicit array shape/dtype validation. If pickle must be used, implement file integrity verification (e.g., cryptographic signature) and load from a read-only trusted location.

Changes

• src/akkudoktoreos/prediction/interpolator.py (modified)
• src/akkudoktoreos/prediction/elecpriceimport.py (modified)

[b0661]

Hello @tomaioo, please add a test that shows that your changes are working.

Currently I doubt it because you did not convert the pickled file to a format that that can be loaded by your changed method. I would say your AI should do some extra rounds.