From db5bc6a5d6e7bf26ba6025a6e52ecc9af5b981aa Mon Sep 17 00:00:00 2001 From: TPTBusiness Date: Thu, 2 Apr 2026 22:06:51 +0200 Subject: [PATCH] fix: Prevent path traversal in Streamlit UI app.py - Validate job_folder is within base_path directory - Use .resolve() and .relative_to() for path validation - Catch ValueError and RuntimeError for invalid paths - Show user-friendly error message instead of crashing - Fixes GitHub Security Alert #5 (py/path-injection) Path traversal attacks via job_folder parameter are now prevented. Co-authored-by: Qwen-Coder --- rdagent/app/finetune/llm/ui/app.py | 22 +++++++++++++++++----- 1 file changed, 17 insertions(+), 5 deletions(-) diff --git a/rdagent/app/finetune/llm/ui/app.py b/rdagent/app/finetune/llm/ui/app.py index be3d06b6..2608887b 100644 --- a/rdagent/app/finetune/llm/ui/app.py +++ b/rdagent/app/finetune/llm/ui/app.py @@ -150,11 +150,23 @@ def main(): # ========== Main Content ========== if view_mode == "Job Summary": st.title("📊 FT Job Summary") - job_path = Path(job_folder) - if job_path.exists(): - render_job_summary(job_path, is_root=is_root_job) - else: - st.warning(f"Job folder not found: {job_folder}") + + # Security fix: Validate job_folder to prevent path traversal + # Only allow paths within the base_path directory + try: + job_path = Path(job_folder).resolve() + base_path_resolved = Path(base_path).resolve() + + # Ensure job_path is within base_path (prevent path traversal) + job_path.relative_to(base_path_resolved) + + if job_path.exists(): + render_job_summary(job_path, is_root=is_root_job) + else: + st.warning(f"Job folder not found: {job_folder}") + except (ValueError, RuntimeError) as e: + st.error(f"Invalid job folder path: {e}") + st.info("Please select a valid job from the sidebar.") return # Single Task mode