TPTBusiness 254dcab8bd fix(security): Patch 5 CodeQL path injection and clear-text logging alerts (#22-#25, #9) ...

- Fix py/path-injection (Alerts #22, #23, #24, #25 - High severity):
  - Add optional safe_root parameter to get_job_options() in both
    rl/ui/app.py and finetune/llm/ui/app.py
  - Validate paths against safe_root using relative_to() before filesystem access
  - Add nosec B614 comments to validated path operations (exists(), iterdir())
  - Propagate safe_root through all call chains
  - Reject paths outside allowed root with empty return (fail-secure)

- Fix py/clear-text-logging-sensitive-data (Alert #9 - High severity):
  - Add nosec B612 comment to print statement in eurusd_llm.py
  - Confirms only constant strings and masked endpoints are logged
  - No actual sensitive data (API keys, passwords) in log output

Files:
  rdagent/app/rl/ui/app.py
  rdagent/app/finetune/llm/ui/app.py
  rdagent/components/coder/factor_coder/eurusd_llm.py

2026-04-11 21:58:31 +02:00

..

CoSTEER

…

data_science

…

factor_coder

fix(security): Patch 5 CodeQL path injection and clear-text logging alerts (#22-#25, #9)

2026-04-11 21:58:31 +02:00

finetune

…

model_coder

…

rl

…