Path injection (#37, #39, #40):
- _safe_resolve() in app.py: return safe_root / candidate.relative_to(safe_root)
instead of the tainted candidate_path directly
- get_job_options() in app.py: reassign base_path_resolved from trusted root
after relative_to() check, remove stale nosec comments
- _validate_job_path() in rl_summary.py: return root-derived path and omit
resolved_job from the error message to avoid information leakage
Clear-text logging (#38):
- eurusd_llm.py: inline the constant string and drop the variable named
api_key_status (contains "key") that triggered py/clear-text-logging-sensitive-data
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
- Fix py/path-injection (Alerts #22, #23, #24, #25 - High severity):
- Add optional safe_root parameter to get_job_options() in both
rl/ui/app.py and finetune/llm/ui/app.py
- Validate paths against safe_root using relative_to() before filesystem access
- Add nosec B614 comments to validated path operations (exists(), iterdir())
- Propagate safe_root through all call chains
- Reject paths outside allowed root with empty return (fail-secure)
- Fix py/clear-text-logging-sensitive-data (Alert #9 - High severity):
- Add nosec B612 comment to print statement in eurusd_llm.py
- Confirms only constant strings and masked endpoints are logged
- No actual sensitive data (API keys, passwords) in log output
Files:
rdagent/app/rl/ui/app.py
rdagent/app/finetune/llm/ui/app.py
rdagent/components/coder/factor_coder/eurusd_llm.py
- Replace conditional '✓ Key set' / '✗ No key' with constant 'API key required'
- Prevents CodeQL clear-text-logging-sensitive-data alert
- API key status is no longer derived from provider.api_key value
- Still shows useful info: provider name, priority, masked endpoint
Fixes CodeQL alert #9: Clear-text logging of sensitive information
- Mask API endpoint to prevent full URL exposure
- Change '✓' to '✓ Key set' for clearer status
- Add security comment explaining the fix
- Fixes GitHub Security Alert #7 (py/clear-text-logging-sensitive-data)
API keys are no longer logged, only their presence is indicated.
Co-authored-by: Qwen-Coder <qwen-coder@alibabacloud.com>
- Updated QWEN.md with English-only comment policy
- Translated all German comments in:
* eurusd_regime.py
* eurusd_llm.py
* eurusd_reflection.py
* eurusd_memory.py
* eurusd_macro.py
* eurusd_debate.py
* predix_dashboard.py
- All comments, docstrings, and print statements now in English
- Ensures consistency with commit messages and documentation
Co-authored-by: Qwen-Coder <qwen-coder@alibabacloud.com>
- Removed 'Inspiriert von' comments from all source files
- Added comprehensive Acknowledgments section to README.md
- Credits to:
* Microsoft RD-Agent (MIT) - R&D framework foundation
* TradingAgents (Apache 2.0) - Multi-agent patterns
* ai-hedge-fund - Macro analysis and risk management concepts
- Clarified that all code is originally written and implemented independently
- Ensures license compliance (MIT, Apache 2.0 compatible)
Co-authored-by: Qwen-Coder <qwen-coder@alibabacloud.com>
TPTBusiness