TPTBusiness 0fa4f5dcc8 fix(security): replace shell=True subprocess calls with list args (B602) ...

- factor.py: check_output([python_bin, path]) instead of shell string
- env.py QlibCondaEnv: all four conda commands use list args

Shell=True with a constructed string allows shell injection if
python_bin or path contain shell metacharacters.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

2026-04-30 09:35:09 +02:00

..

app

feat: unified backtest engine, LLM error handling, strategy refactor

2026-04-17 22:52:07 +02:00

components

fix(security): replace shell=True subprocess calls with list args (B602)

2026-04-30 09:35:09 +02:00

core

feat: unified backtest engine, LLM error handling, strategy refactor

2026-04-17 22:52:07 +02:00

log

chore(logging): size-based rotation and cap LLM call content

2026-04-30 07:19:27 +02:00

oai

fix(loop): prevent step_idx advance on unhandled exceptions + fix consecutive assistant messages

2026-04-26 21:33:24 +02:00

scenarios

fix(security): revert broken read_pickle encoding arg in kaggle template (B301)

2026-04-30 07:21:34 +02:00

utils

fix(security): replace shell=True subprocess calls with list args (B602)

2026-04-30 09:35:09 +02:00