From 48843682d07ce81833bcd7e23d4de20621101d16 Mon Sep 17 00:00:00 2001 From: TPTBusiness Date: Thu, 30 Apr 2026 19:26:23 +0200 Subject: [PATCH] fix(security): replace eval() with ast.literal_eval in finetune validator (B307) eval() on trainer stdout output replaced with ast.literal_eval() which only parses Python literals and cannot execute arbitrary code. Co-Authored-By: Claude Sonnet 4.6 --- rdagent/components/coder/finetune/unified_validator.py | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/rdagent/components/coder/finetune/unified_validator.py b/rdagent/components/coder/finetune/unified_validator.py index 19c8e844..dab04767 100644 --- a/rdagent/components/coder/finetune/unified_validator.py +++ b/rdagent/components/coder/finetune/unified_validator.py @@ -6,6 +6,7 @@ Two-step validation: 2. Micro-batch testing - Runtime validation with small dataset """ +import ast import json import re import time @@ -229,7 +230,7 @@ class LLMConfigValidator: final_metrics = re.search(r"\{'train_runtime':[^}]+\}", stdout) if final_metrics: try: - metrics = eval(final_metrics.group(0)) # Safe: only numbers and strings + metrics = ast.literal_eval(final_metrics.group(0)) result["final_metrics"] = { "train_loss": metrics.get("train_loss"), "train_runtime": metrics.get("train_runtime"),