TPTBusiness 0fa4f5dcc8 fix(security): replace shell=True subprocess calls with list args (B602) ...

- factor.py: check_output([python_bin, path]) instead of shell string
- env.py QlibCondaEnv: all four conda commands use list args

Shell=True with a constructed string allows shell injection if
python_bin or path contain shell metacharacters.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

2026-04-30 09:35:09 +02:00

..

agent

feat: add a rag mcp in proposal (#1267)

2025-10-20 16:46:25 +08:00

backtesting

fix(security): whitelist-validate metric column in get_top_factors (B608)

2026-04-30 07:25:14 +02:00

benchmark

feat(rl): add AutoRL-Bench framework and benchmark integrations (#1348)

2026-03-17 15:49:30 +08:00

coder

fix(security): replace shell=True subprocess calls with list args (B602)

2026-04-30 09:35:09 +02:00

document_reader

fix: package dependency. (#234)

2024-08-31 20:35:04 +08:00

interactor

feat: add user interaction in data science scenario (#1251)

2025-09-18 11:10:12 +08:00

knowledge_management

feat: Intelligent embedding chunking instead of truncation

2026-04-02 19:22:50 +02:00

loader

feat(backend): integrate LiteLLM API Backend (#564)

2025-02-13 15:16:18 +08:00

proposal

feat: add a web UI server (#1345)

2026-03-18 14:04:52 +08:00

runner

add feedback to workspace and ds runner base on costeer

2025-02-11 20:50:19 +08:00

workflow

feat: unified backtest engine, LLM error handling, strategy refactor

2026-04-17 22:52:07 +02:00

model_loader.py

feat: Add model loader system (same as prompts)

2026-04-02 22:40:46 +02:00

prompt_loader.py

fix(strategy): Fix template variables, APIBackend import, and JSON extraction

2026-04-12 14:47:25 +02:00