TPTBusiness 150a818e07 fix(security): replace shell=True subprocess calls with list args in env.py (B602) ...

Converted conda commands in _update_bin_path, _sync_conda_cache_with_real_envs,
_prepare_conda_env, and FTCondaEnv.prepare() to list args. Replaced pipe-based
grep with pure Python parsing. LocalEnv.Popen retains shell=True with nosec
since entry is an internal command string set by LocalEnvConf, not user input.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

2026-04-30 19:26:29 +02:00

..

app

fix(security): replace eval() with ast.literal_eval and add request timeouts (B307, B113)

2026-04-30 09:35:09 +02:00

components

fix(security): replace eval() with ast.literal_eval in finetune validator (B307)

2026-04-30 19:26:23 +02:00

core

feat: unified backtest engine, LLM error handling, strategy refactor

2026-04-17 22:52:07 +02:00

log

fix(security): nosec for B608/B701 false positives in UI and template code

2026-04-30 09:35:09 +02:00

oai

fix(loop): prevent step_idx advance on unhandled exceptions + fix consecutive assistant messages

2026-04-26 21:33:24 +02:00

scenarios

fix(qlib): correct indentation in except blocks in quant_proposal and factor_runner

2026-04-30 13:30:49 +02:00

utils

fix(security): replace shell=True subprocess calls with list args in env.py (B602)

2026-04-30 19:26:29 +02:00