From d95f509efe81173583e875906f4c13257c088ba4 Mon Sep 17 00:00:00 2001 From: TPTBusiness Date: Thu, 2 Apr 2026 23:05:25 +0200 Subject: [PATCH] fix: Prevent path injection in FT Job Summary UI - Add explicit validation for path traversal sequences (.., /, \) - Reject job_folder containing path traversal before Path construction - Fixes CodeQL py/path-injection warning (Alert #18) - Existing .relative_to() validation remains as defense-in-depth Security improvements: - Early rejection of malicious paths before Path() construction - Clear error message for users - Maintains existing validation as secondary check Fixes GitHub Code Scanning Alert #18 (py/path-injection) --- rdagent/app/finetune/llm/ui/app.py | 8 ++++++++ 1 file changed, 8 insertions(+) diff --git a/rdagent/app/finetune/llm/ui/app.py b/rdagent/app/finetune/llm/ui/app.py index 0a05af27..89b355dd 100644 --- a/rdagent/app/finetune/llm/ui/app.py +++ b/rdagent/app/finetune/llm/ui/app.py @@ -174,6 +174,14 @@ def main(): # Only allow paths within the base_path directory try: safe_root = Path(base_path).resolve() + + # Additional security: Validate job_folder doesn't contain path traversal sequences + # This prevents CodeQL path-injection warning + if ".." in job_folder or job_folder.startswith("/") or job_folder.startswith("\\"): + st.error("Invalid job folder: Path traversal sequences not allowed") + st.info("Please select a valid job from the sidebar.") + return + job_path = Path(job_folder).expanduser().resolve(strict=False) # Ensure job_path is within safe_root (prevent path traversal)