TPTBusiness 025140afe6 fix(security): validate SQL identifiers in _add_column_if_not_exists (B608) ...

Replace f-string SQL queries with whitelist validation:
- Table name must be in _ALLOWED_TABLES
- Column name must be alphanumeric+underscore
- Column type must be in _ALLOWED_COL_TYPES
- Use pragma_table_info() for existence check instead of SELECT f-string

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

2026-04-30 07:21:13 +02:00

..

agent

feat: add a rag mcp in proposal (#1267)

2025-10-20 16:46:25 +08:00

backtesting

fix(security): validate SQL identifiers in _add_column_if_not_exists (B608)

2026-04-30 07:21:13 +02:00

benchmark

feat(rl): add AutoRL-Bench framework and benchmark integrations (#1348)

2026-03-17 15:49:30 +08:00

coder

fix(auto-fixer): replace zero \$volume with price-range proxy for FX data

2026-04-27 16:07:06 +02:00

document_reader

fix: package dependency. (#234)

2024-08-31 20:35:04 +08:00

interactor

feat: add user interaction in data science scenario (#1251)

2025-09-18 11:10:12 +08:00

knowledge_management

feat: Intelligent embedding chunking instead of truncation

2026-04-02 19:22:50 +02:00

loader

feat(backend): integrate LiteLLM API Backend (#564)

2025-02-13 15:16:18 +08:00

proposal

feat: add a web UI server (#1345)

2026-03-18 14:04:52 +08:00

runner

add feedback to workspace and ds runner base on costeer

2025-02-11 20:50:19 +08:00

workflow

feat: unified backtest engine, LLM error handling, strategy refactor

2026-04-17 22:52:07 +02:00

model_loader.py

feat: Add model loader system (same as prompts)

2026-04-02 22:40:46 +02:00

prompt_loader.py

fix(strategy): Fix template variables, APIBackend import, and JSON extraction

2026-04-12 14:47:25 +02:00