fix: Prevent path traversal in Streamlit UI app.py

- Validate job_folder is within base_path directory
- Use .resolve() and .relative_to() for path validation
- Catch ValueError and RuntimeError for invalid paths
- Show user-friendly error message instead of crashing
- Fixes GitHub Security Alert #5 (py/path-injection)

Path traversal attacks via job_folder parameter are now prevented.

Co-authored-by: Qwen-Coder <qwen-coder@alibabacloud.com>

rdagent/app/finetune/llm/ui/app.py

@@ -150,11 +150,23 @@ def main():
     # ========== Main Content ==========
     if view_mode == "Job Summary":
         st.title("📊 FT Job Summary")
-        job_path = Path(job_folder)
+        
-        if job_path.exists():
+        # Security fix: Validate job_folder to prevent path traversal
-            render_job_summary(job_path, is_root=is_root_job)
+        # Only allow paths within the base_path directory
-        else:
+        try:
-            st.warning(f"Job folder not found: {job_folder}")
+            job_path = Path(job_folder).resolve()
+            base_path_resolved = Path(base_path).resolve()
+            
+            # Ensure job_path is within base_path (prevent path traversal)
+            job_path.relative_to(base_path_resolved)
+            
+            if job_path.exists():
+                render_job_summary(job_path, is_root=is_root_job)
+            else:
+                st.warning(f"Job folder not found: {job_folder}")
+        except (ValueError, RuntimeError) as e:
+            st.error(f"Invalid job folder path: {e}")
+            st.info("Please select a valid job from the sidebar.")
         return
 
     # Single Task mode