TPTBusiness 48843682d0 fix(security): replace eval() with ast.literal_eval in finetune validator (B307) ...

eval() on trainer stdout output replaced with ast.literal_eval() which only
parses Python literals and cannot execute arbitrary code.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

2026-04-30 19:26:23 +02:00

..

app

fix(security): replace eval() with ast.literal_eval and add request timeouts (B307, B113)

2026-04-30 09:35:09 +02:00

components

fix(security): replace eval() with ast.literal_eval in finetune validator (B307)

2026-04-30 19:26:23 +02:00

core

feat: unified backtest engine, LLM error handling, strategy refactor

2026-04-17 22:52:07 +02:00

log

fix(security): nosec for B608/B701 false positives in UI and template code

2026-04-30 09:35:09 +02:00

oai

fix(loop): prevent step_idx advance on unhandled exceptions + fix consecutive assistant messages

2026-04-26 21:33:24 +02:00

scenarios

fix(qlib): correct indentation in except blocks in quant_proposal and factor_runner

2026-04-30 13:30:49 +02:00

utils

fix(security): replace shell=True subprocess calls with list args (B602)

2026-04-30 09:35:09 +02:00