From 40788b8670ffde808cb0fba016c577387a42e7fa Mon Sep 17 00:00:00 2001
From: TPTBusiness <tpt.requests@pm.me>
Date: Thu, 2 Apr 2026 23:06:05 +0200
Subject: [PATCH] docs: Translate server.py comments to English

- Translate resolve_model_path() docstring from Chinese to English
- Add detailed security validation steps documentation
- Follows project language policy (all comments in English)

No functional changes - documentation only.
---
 .../scenarios/rl/autorl_bench/core/server.py  | 32 ++++++++++++-------
 1 file changed, 21 insertions(+), 11 deletions(-)

diff --git a/rdagent/scenarios/rl/autorl_bench/core/server.py b/rdagent/scenarios/rl/autorl_bench/core/server.py
index 1c7ab810..b31bf0ee 100644
--- a/rdagent/scenarios/rl/autorl_bench/core/server.py
+++ b/rdagent/scenarios/rl/autorl_bench/core/server.py
@@ -89,38 +89,48 @@ class GradingServer:
         return get_evaluator(self.task)
 
     def resolve_model_path(self, model_path: str) -> Path:
-        """将模型路径约束在 workspace 下，防止访问任意文件系统路径。"""
-        # Security fix: Validate and sanitize user-provided path to prevent path traversal
+        """
+        Resolve model path safely within workspace directory.
         
+        Security: Prevents path traversal attacks by validating user-provided paths.
+        Only allows access to files within the workspace directory.
+        
+        Validation steps:
+        1. Reject null bytes
+        2. Normalize path to remove .. and . components
+        3. Reject Windows drive letters
+        4. Reject absolute paths
+        5. Resolve to absolute path
+        6. Verify resolved path is within workspace_root using relative_to()
+        """
         # Reject null bytes
         if "\x00" in model_path:
             raise ValueError("Invalid model_path: contains null byte")
 
         workspace_root = self.workspace.expanduser().resolve()
-        
+
         # Normalize path to remove .. and . components
         normalized = os.path.normpath(model_path)
-        
+
         # Reject Windows drive letters (e.g., C:\)
         if os.path.splitdrive(normalized)[0]:
             raise ValueError("Invalid model_path: contains drive letter")
-        
+
         # Reject absolute paths
         if os.path.isabs(normalized):
             raise ValueError("Invalid model_path: must be relative path")
-        
-        # Join with workspace root
+
+        # Join with workspace root and resolve to absolute path
         candidate = os.path.join(str(workspace_root), normalized)
-        
-        # Resolve to absolute path and verify it's under workspace_root
         resolved_path = Path(candidate).expanduser().resolve(strict=False)
-        
+
         # Security check: ensure resolved path is within workspace_root
+        # This validates that the user-supplied model_path didn't escape the workspace
         try:
             resolved_path.relative_to(workspace_root)
         except ValueError as exc:
             raise ValueError(f"Invalid model_path: path traversal detected - {model_path}") from exc
-        
+
         return resolved_path
 
     def submit(self, model_path: str, gpu: Optional[str] = None) -> dict: