TPTBusiness 6358bc500f fix(security): Patch path injection and stack trace exposure (CodeQL #31, #27) ...

- Fix py/path-injection (Alert #31, High severity):
  - Add _validate_job_path() to resolve and canonicalize paths
  - Enforce job_path stays within safe_root via relative_to()
  - Update get_max_loops(), get_job_summary_df(), render_job_summary()
    to accept and validate safe_root parameter
  - Update app.py caller to pass safe_root to render_job_summary()
  - On validation failure: return empty data / show warning

- Fix py/stack-trace-exposure (Alert #27, Medium severity):
  - Remove str(e) from error response in get_live_fx_data()
  - Replace with generic message: 'Internal error while fetching live FX data'
  - Remove unused exception variable to prevent accidental leakage

Files:
  rdagent/app/rl/ui/rl_summary.py
  rdagent/app/rl/ui/app.py
  rdagent/components/coder/factor_coder/eurusd_macro.py

2026-04-11 21:50:16 +02:00

..

benchmark

feat(backend): integrate LiteLLM API Backend (#564)

2025-02-13 15:16:18 +08:00

CI

fix mypy error (#91)

2024-07-25 15:20:04 +08:00

data_science

feat: add a web UI server (#1345)

2026-03-18 14:04:52 +08:00

finetune

fix: Harden path validation in Job Summary UI to fix CodeQL alert #17

2026-04-03 10:46:46 +02:00

general_model

chore: remove redundant tag in old scenarios (#917)

2025-06-13 17:49:58 +08:00

kaggle

feat: add option to enable hyperparameter tuning only in first eval loop (#1211)

2025-08-29 16:59:22 +08:00

qlib_rd_loop

feat: Full auto strategy generation in fin_quant loop

2026-04-09 14:13:08 +02:00

rl

fix(security): Patch path injection and stack trace exposure (CodeQL #31, #27)

2026-04-11 21:50:16 +02:00

utils

feat: add a web UI server (#1345)

2026-03-18 14:04:52 +08:00

cli_welcome.py

feat: Add GitHub infrastructure, CI/CD pipelines, and examples

2026-04-11 21:40:18 +02:00

cli.py

feat: Add beautiful CLI welcome screen for GitHub README

2026-04-10 12:10:38 +02:00