fix(security): resolve path-injection, B701, B101, B112 Bandit alerts

- Path injection (B614): centralized safe_resolve_path in core/utils.py,
  refactored 6 UI modules to use it with safe_root validation
- B701: added explicit autoescape=select_autoescape() to Jinja2
  Environment() calls in 3 files
- B101: replaced assert statements with proper if/raise patterns in
  12+ files (partial)
- B112: added logger.warning() to bare except:continue blocks in
  5 files

rdagent/utils/agent/tpl.py

@@ -9,7 +9,7 @@ from pathlib import Path
 from typing import Any
 
 import yaml
-from jinja2 import Environment, FunctionLoader, StrictUndefined
+from jinja2 import Environment, FunctionLoader, StrictUndefined, select_autoescape
 
 from rdagent.core.conf import RD_AGENT_SETTINGS
 from rdagent.log import rdagent_logger as logger
@@ -38,7 +38,8 @@ def load_content(uri: str, caller_dir: Path | None = None, ftype: str = "yaml")
         caller_dir = get_caller_dir(upshift=1)
     # Parse the URI
     path_part, *yaml_trace = uri.split(":")
-    assert len(yaml_trace) <= 1, f"Invalid uri {uri}, only one yaml trace is allowed."
+    if len(yaml_trace) > 1:
+        raise ValueError(f"Invalid uri {uri}, only one yaml trace is allowed.")
     yaml_trace = [key for yt in yaml_trace for key in yt.split(".")]
 
     # load file_path with priorities.
@@ -126,7 +127,7 @@ class RDAT:
         # loader=FunctionLoader(load_conent) is for supporting grammar like below.
         # `{% include "scenarios.data_science.share:component_spec.DataLoadSpec" %}`
         rendered = (
-            Environment(undefined=StrictUndefined, loader=FunctionLoader(load_content))
+            Environment(undefined=StrictUndefined, loader=FunctionLoader(load_content), autoescape=select_autoescape())
             .from_string(self.template)
             .render(**context)
             .strip("\n")

rdagent/utils/workflow/misc.py

@@ -30,7 +30,8 @@ def wait_retry(
     >>> counter
     2
     """
-    assert retry_n > 0, "retry_n should be greater than 0"
+    if retry_n <= 0:
+        raise ValueError("retry_n should be greater than 0")
 
     def decorator(f: Callable[..., ASpecificRet]) -> Callable[..., ASpecificRet]:
         def wrapper(*args: Any, **kwargs: Any) -> ASpecificRet: