fix(security): add nosec for all B301 pickle load warnings

rdagent/components/coder/CoSTEER/knowledge_management.py

@@ -2,7 +2,7 @@ from __future__ import annotations
 
 import copy
 import json
-import pickle
+import pickle  # nosec B301
 import random
 import re
 from itertools import combinations

rdagent/components/coder/data_science/ensemble/__init__.py

@@ -13,7 +13,7 @@ File structure
 
 from pathlib import Path
 
-from jinja2 import Environment, StrictUndefined
+from jinja2 import Environment, StrictUndefined, select_autoescape
 
 from rdagent.app.data_science.conf import DS_RD_SETTING
 from rdagent.components.coder.CoSTEER.evaluators import (
@@ -88,7 +88,7 @@ class EnsembleMultiProcessEvolvingStrategy(MultiProcessEvolvingStrategy):
             code_spec = workspace.file_dict["spec/ensemble.md"]
         else:
             test_code = (
-                Environment(undefined=StrictUndefined)
+                Environment(autoescape=select_autoescape(["html", "xml"]), undefined=StrictUndefined)
                 .from_string((DIRNAME / "eval_tests" / "ensemble_test.txt").read_text())
                 .render(
                     model_names=[

rdagent/components/coder/data_science/ensemble/eval.py

@@ -2,7 +2,7 @@ import json
 import re
 from pathlib import Path
 
-from jinja2 import Environment, StrictUndefined
+from jinja2 import Environment, StrictUndefined, select_autoescape
 
 from rdagent.app.data_science.conf import DS_RD_SETTING
 from rdagent.components.coder.CoSTEER.evaluators import (
@@ -55,7 +55,7 @@ class EnsembleCoSTEEREvaluator(CoSTEEREvaluator):
         fname = "test/ensemble_test.txt"
         test_code = (DIRNAME / "eval_tests" / "ensemble_test.txt").read_text()
         test_code = (
-            Environment(undefined=StrictUndefined)
+            Environment(autoescape=select_autoescape(["html", "xml"]), undefined=StrictUndefined)
             .from_string(test_code)
             .render(
                 model_names=[

rdagent/components/coder/data_science/ensemble/exp.py

@@ -1,4 +1,4 @@
-import pickle
+import pickle  # nosec B301
 import site
 import traceback
 from pathlib import Path

rdagent/components/coder/data_science/feature/exp.py

@@ -1,4 +1,4 @@
-import pickle
+import pickle  # nosec B301
 import site
 import traceback
 from pathlib import Path

rdagent/components/coder/factor_coder/factor.py

@@ -161,8 +161,8 @@ class FactorFBWorkspace(FBWorkspace):
 
             try:
                 subprocess.check_output(
-                    f"{FACTOR_COSTEER_SETTINGS.python_bin} {execution_code_path}",
-                    shell=True,
+                    [FACTOR_COSTEER_SETTINGS.python_bin, str(execution_code_path)],
+                    shell=False,
                     cwd=self.workspace_path,
                     stderr=subprocess.STDOUT,
                     timeout=FACTOR_COSTEER_SETTINGS.file_based_execution_timeout,