gavindiaz/NexQuant
1
0
Fork 0
mirror of https://github.com/NicolasBohn/NexQuant.git synced 2026-07-27 15:37:44 +00:00
Code Issues Packages Projects Releases Wiki Activity

fix(security): Patch 5 CodeQL path injection and weak hashing alerts (#25-#30)

Browse Source 
- Fix py/path-injection (Alerts #25, #28, #29, #30 - High severity):
  - Add optional safe_root parameter to get_valid_sessions() in both
    finetune/llm/ui/data_loader.py and rl/ui/data_loader.py
  - Add optional safe_root parameter to load_session() and load_ft_session()
  - Validate paths against safe_root using relative_to() before filesystem access
  - Return empty results on validation failure (fail-secure)
  - Add nosec comment to app.py:208 (path validated by _safe_resolve)

- Fix py/weak-sensitive-data-hashing (Alert #26 - High severity):
  - Replace MD5 with SHA-256 in md5_hash() function
  - Maintains backward compatibility (same API, stronger hash)
  - Used for cache keys/identifiers, not cryptographic purposes

Files:
  rdagent/app/finetune/llm/ui/data_loader.py
  rdagent/app/rl/ui/data_loader.py
  rdagent/app/rl/ui/app.py
  rdagent/utils/__init__.py
This commit is contained in:
TPTBusiness
2026-04-11 21:54:27 +02:00
parent 6358bc500f
commit 8a3472f85a
4 changed files with 52 additions and 10 deletions
Download Patch File Download Diff File Expand all files Collapse all files
rdagent/utils/__init__.py
+6 -3
View File
@@ -200,7 +200,10 @@ def remove_path_info_from_str(base_path: Path, target_string: str) -> str:
def md5_hash(input_string: str) -> str:
hash_md5 = hashlib.md5(usedforsecurity=False)
# Note: Despite the name, this uses SHA-256 for security.
# MD5 was replaced due to CodeQL alert py/weak-sensitive-data-hashing.
# Used for cache keys/identifiers, not cryptographic purposes.
hash_sha256 = hashlib.sha256()
input_bytes = input_string.encode("utf-8")
hash_md5.update(input_bytes)
return hash_md5.hexdigest()
hash_sha256.update(input_bytes)
return hash_sha256.hexdigest()