TPTBusiness 0fa4f5dcc8 fix(security): replace shell=True subprocess calls with list args (B602) ...

- factor.py: check_output([python_bin, path]) instead of shell string
- env.py QlibCondaEnv: all four conda commands use list args

Shell=True with a constructed string allows shell injection if
python_bin or path contain shell metacharacters.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

2026-04-30 09:35:09 +02:00

..

agent

feat: enable finetune llm (#1055)

2025-08-06 12:24:44 +08:00

blob

feat: add LLM-finetune scenario (#1314)

2026-03-02 19:04:10 +08:00

repo

refactor: Use file dictionaries for diff generation in feedback module (#574)

2025-02-10 09:03:13 +08:00

workflow

fix(loop): prevent step_idx advance on unhandled exceptions + fix consecutive assistant messages

2026-04-26 21:33:24 +02:00

__init__.py

fix(security): Patch 5 CodeQL path injection and weak hashing alerts (#25-#30)

2026-04-11 21:54:27 +02:00

env.py

fix(security): replace shell=True subprocess calls with list args (B602)

2026-04-30 09:35:09 +02:00

fmt.py

fix: fix the bug in the regular expression matching for stdout (#890)

2025-05-23 14:13:31 +08:00

prompts.yaml

fix: update fallback criterion (#1210)

2025-08-29 17:07:41 +08:00

qlib.py

feat: add a web UI server (#1345)

2026-03-18 14:04:52 +08:00