From cdbc80e65818d61370898493c9636202dcec98b0 Mon Sep 17 00:00:00 2001
From: TPTBusiness <tpt.requests@pm.me>
Date: Thu, 2 Apr 2026 23:07:13 +0200
Subject: [PATCH] fix: Prevent path injection in RL Job Summary UI

- Use _safe_resolve() for job_path validation (line 198)
- Fixes CodeQL py/path-injection warning (Alert #3)
- Consistent with FT UI fix (commit 2d48653f)

Security improvements:
- All user-provided paths now go through _safe_resolve()
- Path traversal sequences rejected before filesystem access
- Clear error message for invalid paths

Fixes GitHub Code Scanning Alert #3 (py/path-injection)
---
 rdagent/app/rl/ui/app.py | 6 +++++-
 1 file changed, 5 insertions(+), 1 deletion(-)

diff --git a/rdagent/app/rl/ui/app.py b/rdagent/app/rl/ui/app.py
index b935699d..9aa22aa4 100644
--- a/rdagent/app/rl/ui/app.py
+++ b/rdagent/app/rl/ui/app.py
@@ -195,7 +195,11 @@ def main():
 
     if view_mode == "Job Summary":
         st.title("📊 RL Job Summary")
-        job_path = Path(job_folder).resolve()
+        try:
+            job_path = _safe_resolve(job_folder, safe_root)
+        except ValueError as e:
+            st.warning(str(e))
+            return
         if job_path.exists():
             render_job_summary(job_path, is_root=is_root_job)
         else: