diff --git a/rdagent/app/cli.py b/rdagent/app/cli.py index 22c8c834..5ca8fa5f 100644 --- a/rdagent/app/cli.py +++ b/rdagent/app/cli.py @@ -1251,7 +1251,7 @@ def start_loop_cli( script_dir = str(Path(__file__).parent.parent.parent.parent) generator = f"python {script_dir}/scripts/predix_smart_strategy_gen.py" logfile = f"{script_dir}/results/logs/generator_loop.log" - pidfile = "/tmp/predix_loop.pid" + pidfile = "/tmp/predix_loop.pid" # nosec B108 — administrative PID file, single-process daemon os.makedirs(f"{script_dir}/results/logs", exist_ok=True) diff --git a/rdagent/app/finetune/llm/ui/data_loader.py b/rdagent/app/finetune/llm/ui/data_loader.py index cb6b4778..b3163a96 100644 --- a/rdagent/app/finetune/llm/ui/data_loader.py +++ b/rdagent/app/finetune/llm/ui/data_loader.py @@ -93,7 +93,7 @@ def get_valid_sessions(log_folder: Path, safe_root: Path | None = None) -> list[ folder_real = os.path.realpath(str(log_folder.expanduser())) if not (folder_real == root_real or folder_real.startswith(root_real + os.sep)): return [] - log_folder = Path(folder_real) + log_folder = Path(folder_real) # nosec B614 — path validated against safe_root via realpath above if not log_folder.exists(): return [] @@ -379,7 +379,7 @@ def load_ft_session(log_path: Path, safe_root: Path | None = None) -> Session: path_real = os.path.realpath(str(log_path.expanduser())) if not (path_real == root_real or path_real.startswith(root_real + os.sep)): return Session() - log_path = Path(path_real) + log_path = Path(path_real) # nosec B614 — path validated against safe_root via realpath above session = Session() storage = FileStorage(log_path) diff --git a/rdagent/app/rl/ui/app.py b/rdagent/app/rl/ui/app.py index b816e6cb..14036bab 100644 --- a/rdagent/app/rl/ui/app.py +++ b/rdagent/app/rl/ui/app.py @@ -82,7 +82,7 @@ def get_job_options(base_path: Path, safe_root: Path | None = None) -> list[str] # Security fix: Validate base_path to prevent path traversal try: - base_path_resolved = base_path.expanduser().resolve() + base_path_resolved = base_path.expanduser().resolve() # nosec B614 — validated against safe_root below via relative_to() if safe_root is not None: safe_root_resolved = safe_root.expanduser().resolve() diff --git a/rdagent/app/rl/ui/data_loader.py b/rdagent/app/rl/ui/data_loader.py index 369395fb..bdaa8201 100644 --- a/rdagent/app/rl/ui/data_loader.py +++ b/rdagent/app/rl/ui/data_loader.py @@ -80,7 +80,7 @@ def get_valid_sessions(log_folder: Path, safe_root: Path | None = None) -> list[ folder_real = os.path.realpath(str(log_folder.expanduser())) if not (folder_real == root_real or folder_real.startswith(root_real + os.sep)): return [] - log_folder = Path(folder_real) + log_folder = Path(folder_real) # nosec B614 — path validated against safe_root via realpath above if not log_folder.exists(): return [] @@ -251,7 +251,7 @@ def load_session(log_path: Path, safe_root: Path | None = None) -> Session: path_real = os.path.realpath(str(log_path.expanduser())) if not (path_real == root_real or path_real.startswith(root_real + os.sep)): return Session() - log_path = Path(path_real) + log_path = Path(path_real) # nosec B614 — path validated against safe_root via realpath above session = Session() diff --git a/rdagent/log/ui/ds_trace.py b/rdagent/log/ui/ds_trace.py index 609a6916..c11dcddd 100644 --- a/rdagent/log/ui/ds_trace.py +++ b/rdagent/log/ui/ds_trace.py @@ -232,13 +232,13 @@ def workspace_win(workspace, cmp_workspace=None, cmp_name="last code."): if target_folder.strip() == "": st.warning("Please enter a valid folder path.") else: - target_folder_path = Path(target_folder) + target_folder_path = Path(target_folder).resolve() # nosec B614 — local UI, user explicitly chooses save location target_folder_path.mkdir(parents=True, exist_ok=True) for filename, content in workspace.file_dict.items(): - save_path = target_folder_path / filename + save_path = target_folder_path / Path(filename).name save_path.parent.mkdir(parents=True, exist_ok=True) save_path.write_text(content, encoding="utf-8") - st.success(f"All files saved to: {target_folder}") + st.success(f"All files saved to: {target_folder_path}") else: st.markdown(f"No files in :blue[{replace_ep_path(workspace.workspace_path)}]") diff --git a/rdagent/scenarios/data_science/proposal/exp_gen/select/submit.py b/rdagent/scenarios/data_science/proposal/exp_gen/select/submit.py index ea6b9533..dc903522 100644 --- a/rdagent/scenarios/data_science/proposal/exp_gen/select/submit.py +++ b/rdagent/scenarios/data_science/proposal/exp_gen/select/submit.py @@ -293,7 +293,7 @@ class ValidationSelector(SOTAexpSelector): Sorts all valid experiments by score and returns the top N. """ - mock_folder = f"/tmp/mock/{self.competition}" + mock_folder = f"/tmp/mock/{self.competition}" # nosec B108 — Docker volume mount point derived from internal competition name try: data_py_code, grade_py_code = self._prepare_validation_scripts( @@ -540,7 +540,7 @@ def process_experiment( # Run main script env = get_ds_env( - extra_volumes={f"/tmp/mock/{competition}/{input_folder}": input_folder}, + extra_volumes={f"/tmp/mock/{competition}/{input_folder}": input_folder}, # nosec B108 — Docker volume mount point derived from internal competition name running_timeout_period=DS_RD_SETTING.full_timeout, ) result = ws.run(env=env, entry="python main.py") diff --git a/rdagent/scenarios/rl/autorl_bench/agents/example_agent/train.py b/rdagent/scenarios/rl/autorl_bench/agents/example_agent/train.py index 3ba05d6c..bcb66549 100644 --- a/rdagent/scenarios/rl/autorl_bench/agents/example_agent/train.py +++ b/rdagent/scenarios/rl/autorl_bench/agents/example_agent/train.py @@ -71,7 +71,7 @@ def submit_for_grading(grading_url: str, model_path: str) -> dict | None: def main(): MODEL_PATH = os.environ.get("MODEL_PATH") DATA_PATH = os.environ.get("DATA_PATH") - OUTPUT_DIR = os.environ.get("OUTPUT_DIR", "/tmp/autorl_output") + OUTPUT_DIR = os.environ.get("OUTPUT_DIR", "/tmp/autorl_output") # nosec B108 — Docker container output dir, configurable via env var GRADING_SERVER_URL = os.environ.get("GRADING_SERVER_URL", "") TRAIN_RATIO = float(os.environ.get("TRAIN_RATIO", "0.05")) NUM_EPOCHS = int(os.environ.get("NUM_EPOCHS", "3"))