DOC: Document Remote Code Execution risk for Dataframe.query and computation.eval

[r0rshark]

TLDR

This diff adds documentation to the Remote Code Execution risk for Dataframe.query and computation.eval with the same wording used in Dataframe.eval

Details

The Dataframe.query function is internally calling Dataframe.eval here passing the expr parameter.
Dataframe.eval is correctly warning in the documentation that this could lead to Code execution risk.
This is possible because using the @ syntax we can access local variables and by referencing the imported pandas library we can get the os.system function thanks to os being imported inside compat/init.py. In this way passing something like @pd.compat.os.system('whoami') to the expr parameter of Dataframe.query we can achieve code execution.

However in Dataframe.query documentation we do not surface this risk we only point out that pandas.eval is called but also there we do not warn about any code execution risks.

The vulnerable code I found and that also surprised the developer who wrote it of the code execution risk can be summarized in UserControlled input flowing into the DataFrame.query expr value similarly to

import pandas as pd

def api_whatever(request: HTTPRequest):
  filter = request.GET["filter"]
  data = {
    "test": [125, 230, 412],
  }
  df = pd.DataFrame(data)
  df.query(filter)
   ... 

Calling this api with data:
https://[email protected]('whoami')
will allow code execution.

[WillAyd]

lgtm @jorisvandenbossche

[rhshadrach]

Thanks for the PR!

[rhshadrach]

Suggested change

	This function pass the `expr` parameter to :meth:`~pandas.DataFrame.eval`.
	This allows `eval` to run arbitrary code, which can make you vulnerable to code
	injection if you pass user input to this function.
	This method can run arbitrary code, which can make you vulnerable to code
	injection if you pass user input to this function.

I don't think we need to mention the implementation details; it's sufficient to warn that query can run arbitrary code.

[rhshadrach]

This is an internal method, right? In such case, I don't think this is necessary.

[rhshadrach]

Ah - this is exposed at the top level. Agree with including it, but I don't think starting with This is accurate - it
reads to me like that refers to the previous sentence. Can just say

eval can run arbitrary code, ...

[rhshadrach]

lgtm

[rhshadrach]

Thanks @r0rshark!