TPTBusiness ec2b8ec7af fix(security): replace relative_to() with realpath+startswith for CodeQL sanitization ...

Path injection (#22, #28, #29, #30):
- Switch from Path.relative_to() to os.path.realpath() + str.startswith()
  in all four path-validation sites across finetune and rl UI data_loader.py
  and finetune app.py. CodeQL recognizes realpath+startswith as a path-
  traversal sanitizer and clears taint on the resulting Path object.
- Also simplify finetune/app.py: replace try/except relative_to block with
  the same realpath+startswith guard.

Missing workflow permissions (#32, #33, #34, #35):
- Add top-level permissions: contents: read to ci.yml, docs.yml, lint.yml,
  and security.yml. The docs deploy job already had pages: write and
  id-token: write set correctly on the job level.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

2026-04-17 21:59:03 +02:00

..

ISSUE_TEMPLATE

feat: Add GitHub infrastructure, CI/CD pipelines, and examples

2026-04-11 21:40:18 +02:00

workflows

fix(security): replace relative_to() with realpath+startswith for CodeQL sanitization

2026-04-17 21:59:03 +02:00

CODEOWNERS

feat: Add GitHub infrastructure, CI/CD pipelines, and examples

2026-04-11 21:40:18 +02:00

PULL_REQUEST_TEMPLATE.md

feat: Add GitHub infrastructure, CI/CD pipelines, and examples

2026-04-11 21:40:18 +02:00