Security: eval() in ws_data_to_dict() allows code execution via WebSocket input

Summary

foxbit_utils.ws_data_to_dict() uses Python's eval() to deserialize WebSocket message strings. Because eval() executes arbitrary Python code, anything passing through this function that originates from a network-controlled source becomes a code execution path.

I sent a detailed report with reproduction steps and test artifacts to [email protected]. Happy to share the full writeup here or through whichever channel works best for the team.

Affected Code

File: hummingbot/connector/exchange/foxbit/foxbit_utils.py#L70

def ws_data_to_dict(data: str) -> Dict[str, Any]:
    return eval(data.replace(":null", ":None").replace(":false", ":False").replace(":true", ":True"))

The .replace() calls exist because the input is JSON, but json.loads() handles null, false, and true natively. There's no need for eval() here.

Impact

Anyone able to inject into the Foxbit WebSocket stream — via MITM, DNS hijack, or a compromised exchange endpoint — can run arbitrary Python code on the machine running the bot. In the official Docker image, the process runs as root.

Suggested Fix

import json  # already imported in this file

def ws_data_to_dict(data: str) -> Dict[str, Any]:
    return json.loads(data)

I've submitted a pull request with this fix and tests as well.