gavindiaz/NexQuant
1
0
Fork 0
mirror of https://github.com/NicolasBohn/NexQuant.git synced 2026-08-05 19:17:43 +00:00
Code Issues Packages Projects Releases Wiki Activity

fix: Add Bandit security scanning and fix critical vulnerabilities

Browse Source 
- Add Bandit security scanner to requirements and pre-commit hooks
- Fix CWE-22 path traversal in tarfile/zipfile extraction (3 files)
  * Add _safe_extract() validation in submit.py, env.py, kaggle_crawler.py
  * Prevents malicious archives from writing outside target directory
- Fix MD5 hashlib calls with usedforsecurity=False flag (2 files)
  * submission_format_test.txt files for checksum validation
- Configure .bandit.yml for automated security scanning
  * Skip known false positives: B602 (subprocess), B701 (Jinja2)
- Add security runbook documentation in docs/security/
- Add pre-commit hook scripts for automated Bandit scanning

All 106 backtesting and security tests pass.
Security issues resolved: B201, B202, B324 (9 total fixes)
This commit is contained in:
TPTBusiness
2026-04-03 11:55:05 +02:00
parent 820c27f91b
commit f3a2e2b4f1
10 changed files with 363 additions and 12 deletions
Download Patch File Download Diff File Expand all files Collapse all files
rdagent/components/coder/data_science/pipeline/eval_tests/submission_format_test.txt
+1 -1
View File
@@ -5,7 +5,7 @@ import pandas as pd
def calculate_md5(file_path):
with open(file_path, "rb") as f:
file_hash = hashlib.md5(f.read()).hexdigest()
file_hash = hashlib.md5(f.read(), usedforsecurity=False).hexdigest()
return file_hash
rdagent/components/coder/data_science/workflow/eval_tests/submission_format_test.txt
+1 -1
View File
@@ -4,7 +4,7 @@ import hashlib
def calculate_md5(file_path):
with open(file_path, "rb") as f:
file_hash = hashlib.md5(f.read()).hexdigest()
file_hash = hashlib.md5(f.read(), usedforsecurity=False).hexdigest()
return file_hash
file_md5 = calculate_md5("scores.csv")