From 2a6839e999ebd2763f6f7e88973bde1f2a9ecf7c Mon Sep 17 00:00:00 2001 From: TPTBusiness Date: Tue, 21 Apr 2026 22:19:06 +0200 Subject: [PATCH] fix(security): resolve all 30 Bandit security alerts (B301, B614, B104) MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit - B301 (pickle): add nosec B301 to pd.read_pickle calls in Kaggle templates — files are trusted Kaggle-environment inputs, not user-supplied - B614 (torch.load): add weights_only=True to all torch.load calls in model benchmark GT code and gt_code.py - B104 (binding 0.0.0.0): change run_server and CLI default to 127.0.0.1; add nosec comment where all-interface binding is required for Docker Co-Authored-By: Claude Sonnet 4.6 --- .../coder/model_coder/benchmark/gt_code/A-DGN.py | 4 ++-- .../coder/model_coder/benchmark/gt_code/dirgnn.py | 4 ++-- .../coder/model_coder/benchmark/gt_code/gpsconv.py | 4 ++-- .../coder/model_coder/benchmark/gt_code/linkx.py | 4 ++-- .../coder/model_coder/benchmark/gt_code/pmlp.py | 4 ++-- .../coder/model_coder/benchmark/gt_code/visnet.py | 4 ++-- rdagent/components/coder/model_coder/gt_code.py | 4 ++-- .../meta_tpl_deprecated/fea_share_preprocess.py | 12 ++++++------ .../playground-series-s3e26/fea_share_preprocess.py | 10 +++++----- .../playground-series-s4e8/fea_share_preprocess.py | 12 ++++++------ rdagent/scenarios/rl/autorl_bench/core/server.py | 6 +++--- 11 files changed, 34 insertions(+), 34 deletions(-) diff --git a/rdagent/components/coder/model_coder/benchmark/gt_code/A-DGN.py b/rdagent/components/coder/model_coder/benchmark/gt_code/A-DGN.py index 5c65bf12..e741924f 100644 --- a/rdagent/components/coder/model_coder/benchmark/gt_code/A-DGN.py +++ b/rdagent/components/coder/model_coder/benchmark/gt_code/A-DGN.py @@ -123,8 +123,8 @@ model_cls = AntiSymmetricConv if __name__ == "__main__": - node_features = torch.load("node_features.pt") - edge_index = torch.load("edge_index.pt") + node_features = torch.load("node_features.pt", weights_only=True) + edge_index = torch.load("edge_index.pt", weights_only=True) # Model instantiation and forward pass model = AntiSymmetricConv(in_channels=node_features.size(-1)) diff --git a/rdagent/components/coder/model_coder/benchmark/gt_code/dirgnn.py b/rdagent/components/coder/model_coder/benchmark/gt_code/dirgnn.py index d22cb898..9cb14bf7 100644 --- a/rdagent/components/coder/model_coder/benchmark/gt_code/dirgnn.py +++ b/rdagent/components/coder/model_coder/benchmark/gt_code/dirgnn.py @@ -78,8 +78,8 @@ model_cls = DirGNNConv if __name__ == "__main__": - node_features = torch.load("node_features.pt") - edge_index = torch.load("edge_index.pt") + node_features = torch.load("node_features.pt", weights_only=True) + edge_index = torch.load("edge_index.pt", weights_only=True) # Model instantiation and forward pass model = DirGNNConv(MessagePassing()) diff --git a/rdagent/components/coder/model_coder/benchmark/gt_code/gpsconv.py b/rdagent/components/coder/model_coder/benchmark/gt_code/gpsconv.py index 305b30e3..0fe66a8d 100644 --- a/rdagent/components/coder/model_coder/benchmark/gt_code/gpsconv.py +++ b/rdagent/components/coder/model_coder/benchmark/gt_code/gpsconv.py @@ -187,8 +187,8 @@ model_cls = GPSConv if __name__ == "__main__": - node_features = torch.load("node_features.pt") - edge_index = torch.load("edge_index.pt") + node_features = torch.load("node_features.pt", weights_only=True) + edge_index = torch.load("edge_index.pt", weights_only=True) # Model instantiation and forward pass model = GPSConv(channels=node_features.size(-1), conv=MessagePassing()) diff --git a/rdagent/components/coder/model_coder/benchmark/gt_code/linkx.py b/rdagent/components/coder/model_coder/benchmark/gt_code/linkx.py index fc71e86d..3e7927db 100644 --- a/rdagent/components/coder/model_coder/benchmark/gt_code/linkx.py +++ b/rdagent/components/coder/model_coder/benchmark/gt_code/linkx.py @@ -170,8 +170,8 @@ class LINKX(torch.nn.Module): model_cls = LINKX if __name__ == "__main__": - node_features = torch.load("node_features.pt") - edge_index = torch.load("edge_index.pt") + node_features = torch.load("node_features.pt", weights_only=True) + edge_index = torch.load("edge_index.pt", weights_only=True) # Model instantiation and forward pass model = LINKX( diff --git a/rdagent/components/coder/model_coder/benchmark/gt_code/pmlp.py b/rdagent/components/coder/model_coder/benchmark/gt_code/pmlp.py index 3dadd76d..9b51a95b 100644 --- a/rdagent/components/coder/model_coder/benchmark/gt_code/pmlp.py +++ b/rdagent/components/coder/model_coder/benchmark/gt_code/pmlp.py @@ -102,8 +102,8 @@ class PMLP(torch.nn.Module): model_cls = PMLP if __name__ == "__main__": - node_features = torch.load("node_features.pt") - edge_index = torch.load("edge_index.pt") + node_features = torch.load("node_features.pt", weights_only=True) + edge_index = torch.load("edge_index.pt", weights_only=True) # Model instantiation and forward pass model = PMLP( diff --git a/rdagent/components/coder/model_coder/benchmark/gt_code/visnet.py b/rdagent/components/coder/model_coder/benchmark/gt_code/visnet.py index 67cff208..4f04c54e 100644 --- a/rdagent/components/coder/model_coder/benchmark/gt_code/visnet.py +++ b/rdagent/components/coder/model_coder/benchmark/gt_code/visnet.py @@ -1180,8 +1180,8 @@ model_cls = ViSNet if __name__ == "__main__": - node_features = torch.load("node_features.pt") - edge_index = torch.load("edge_index.pt") + node_features = torch.load("node_features.pt", weights_only=True) + edge_index = torch.load("edge_index.pt", weights_only=True) # Model instantiation and forward pass model = ViSNet() diff --git a/rdagent/components/coder/model_coder/gt_code.py b/rdagent/components/coder/model_coder/gt_code.py index 988273a3..87ad2e59 100644 --- a/rdagent/components/coder/model_coder/gt_code.py +++ b/rdagent/components/coder/model_coder/gt_code.py @@ -125,8 +125,8 @@ class AntiSymmetricConv(torch.nn.Module): if __name__ == "__main__": - node_features = torch.load("node_features.pt") - edge_index = torch.load("edge_index.pt") + node_features = torch.load("node_features.pt", weights_only=True) + edge_index = torch.load("edge_index.pt", weights_only=True) # Model instantiation and forward pass model = AntiSymmetricConv(in_channels=node_features.size(-1)) diff --git a/rdagent/scenarios/kaggle/experiment/templates/meta_tpl_deprecated/fea_share_preprocess.py b/rdagent/scenarios/kaggle/experiment/templates/meta_tpl_deprecated/fea_share_preprocess.py index c0ef8819..fec3a347 100644 --- a/rdagent/scenarios/kaggle/experiment/templates/meta_tpl_deprecated/fea_share_preprocess.py +++ b/rdagent/scenarios/kaggle/experiment/templates/meta_tpl_deprecated/fea_share_preprocess.py @@ -85,12 +85,12 @@ def preprocess_script(): This method applies the preprocessing steps to the training, validation, and test datasets. """ if os.path.exists("/kaggle/input/X_train.pkl"): - X_train = pd.read_pickle("/kaggle/input/X_train.pkl") - X_valid = pd.read_pickle("/kaggle/input/X_valid.pkl") - y_train = pd.read_pickle("/kaggle/input/y_train.pkl") - y_valid = pd.read_pickle("/kaggle/input/y_valid.pkl") - X_test = pd.read_pickle("/kaggle/input/X_test.pkl") - others = pd.read_pickle("/kaggle/input/others.pkl") + X_train = pd.read_pickle("/kaggle/input/X_train.pkl") # nosec B301 + X_valid = pd.read_pickle("/kaggle/input/X_valid.pkl") # nosec B301 + y_train = pd.read_pickle("/kaggle/input/y_train.pkl") # nosec B301 + y_valid = pd.read_pickle("/kaggle/input/y_valid.pkl") # nosec B301 + X_test = pd.read_pickle("/kaggle/input/X_test.pkl") # nosec B301 + others = pd.read_pickle("/kaggle/input/others.pkl") # nosec B301 return X_train, X_valid, y_train, y_valid, X_test, *others X_train, X_valid, y_train, y_valid = prepreprocess() diff --git a/rdagent/scenarios/kaggle/experiment/templates/playground-series-s3e26/fea_share_preprocess.py b/rdagent/scenarios/kaggle/experiment/templates/playground-series-s3e26/fea_share_preprocess.py index da87728b..04fbccbb 100644 --- a/rdagent/scenarios/kaggle/experiment/templates/playground-series-s3e26/fea_share_preprocess.py +++ b/rdagent/scenarios/kaggle/experiment/templates/playground-series-s3e26/fea_share_preprocess.py @@ -82,11 +82,11 @@ def preprocess_script(): This method applies the preprocessing steps to the training, validation, and test datasets. """ if os.path.exists("X_train.pkl"): - X_train = pd.read_pickle("X_train.pkl") - X_valid = pd.read_pickle("X_valid.pkl") - y_train = pd.read_pickle("y_train.pkl") - y_valid = pd.read_pickle("y_valid.pkl") - X_test = pd.read_pickle("X_test.pkl") + X_train = pd.read_pickle("X_train.pkl") # nosec B301 + X_valid = pd.read_pickle("X_valid.pkl") # nosec B301 + y_train = pd.read_pickle("y_train.pkl") # nosec B301 + y_valid = pd.read_pickle("y_valid.pkl") # nosec B301 + X_test = pd.read_pickle("X_test.pkl") # nosec B301 return X_train, X_valid, y_train, y_valid, X_test X_train, X_valid, y_train, y_valid, test, status_encoder, test_ids = prepreprocess() diff --git a/rdagent/scenarios/kaggle/experiment/templates/playground-series-s4e8/fea_share_preprocess.py b/rdagent/scenarios/kaggle/experiment/templates/playground-series-s4e8/fea_share_preprocess.py index 3ea31cd1..6a6ca34f 100644 --- a/rdagent/scenarios/kaggle/experiment/templates/playground-series-s4e8/fea_share_preprocess.py +++ b/rdagent/scenarios/kaggle/experiment/templates/playground-series-s4e8/fea_share_preprocess.py @@ -73,12 +73,12 @@ def preprocess_script(): This method applies the preprocessing steps to the training, validation, and test datasets. """ if os.path.exists("/kaggle/input/X_train.pkl"): - X_train = pd.read_pickle("/kaggle/input/X_train.pkl") - X_valid = pd.read_pickle("/kaggle/input/X_valid.pkl") - y_train = pd.read_pickle("/kaggle/input/y_train.pkl") - y_valid = pd.read_pickle("/kaggle/input/y_valid.pkl") - X_test = pd.read_pickle("/kaggle/input/X_test.pkl") - others = pd.read_pickle("/kaggle/input/others.pkl") + X_train = pd.read_pickle("/kaggle/input/X_train.pkl") # nosec B301 + X_valid = pd.read_pickle("/kaggle/input/X_valid.pkl") # nosec B301 + y_train = pd.read_pickle("/kaggle/input/y_train.pkl") # nosec B301 + y_valid = pd.read_pickle("/kaggle/input/y_valid.pkl") # nosec B301 + X_test = pd.read_pickle("/kaggle/input/X_test.pkl") # nosec B301 + others = pd.read_pickle("/kaggle/input/others.pkl") # nosec B301 y_train = pd.Series(y_train).reset_index(drop=True) y_valid = pd.Series(y_valid).reset_index(drop=True) diff --git a/rdagent/scenarios/rl/autorl_bench/core/server.py b/rdagent/scenarios/rl/autorl_bench/core/server.py index fbc458ed..6dee8c9f 100644 --- a/rdagent/scenarios/rl/autorl_bench/core/server.py +++ b/rdagent/scenarios/rl/autorl_bench/core/server.py @@ -391,7 +391,7 @@ def set_baseline(): return jsonify({"baseline_score": score, "status": "set"}) -def run_server(task: str, base_model: str, workspace: str, host: str = "0.0.0.0", port: int = 5000): +def run_server(task: str, base_model: str, workspace: str, host: str = "127.0.0.1", port: int = 5000): """启动服务器""" init_server(task, base_model, workspace) logger.info(f"Grading Server | task={task} | {host}:{port}") @@ -435,7 +435,7 @@ class LocalServerContext(GradingServerContext): logger.info(f"[Local Mode] Starting evaluation server on port {self.port}...") self.server = init_server(self.task, self.base_model, self.workspace) - self._http_server = make_server("0.0.0.0", self.port, app, threaded=True) + self._http_server = make_server("0.0.0.0", self.port, app, threaded=True) # nosec B104 — intentional: Docker sandbox requires all-interface binding self._thread = threading.Thread(target=self._http_server.serve_forever, daemon=True) self._thread.start() @@ -488,7 +488,7 @@ if __name__ == "__main__": parser.add_argument("--base-model", type=str, default="") parser.add_argument("--workspace", type=str, default=".") parser.add_argument("--port", type=int, default=5000) - parser.add_argument("--host", type=str, default="0.0.0.0") + parser.add_argument("--host", type=str, default="127.0.0.1") args = parser.parse_args() run_server(args.task, args.base_model, args.workspace, args.host, args.port)