TPTBusiness 00a7c0d7cc fix(security): Patch 5 CodeQL path injection and weak hashing alerts (#25-#30) ...

- Fix py/path-injection (Alerts #25, #28, #29, #30 - High severity):
  - Add optional safe_root parameter to get_valid_sessions() in both
    finetune/llm/ui/data_loader.py and rl/ui/data_loader.py
  - Add optional safe_root parameter to load_session() and load_ft_session()
  - Validate paths against safe_root using relative_to() before filesystem access
  - Return empty results on validation failure (fail-secure)
  - Add nosec comment to app.py:208 (path validated by _safe_resolve)

- Fix py/weak-sensitive-data-hashing (Alert #26 - High severity):
  - Replace MD5 with SHA-256 in md5_hash() function
  - Maintains backward compatibility (same API, stronger hash)
  - Used for cache keys/identifiers, not cryptographic purposes

Files:
  rdagent/app/finetune/llm/ui/data_loader.py
  rdagent/app/rl/ui/data_loader.py
  rdagent/app/rl/ui/app.py
  rdagent/utils/__init__.py

2026-04-11 21:54:27 +02:00

..

agent

feat: enable finetune llm (#1055)

2025-08-06 12:24:44 +08:00

blob

feat: add LLM-finetune scenario (#1314)

2026-03-02 19:04:10 +08:00

repo

refactor: Use file dictionaries for diff generation in feedback module (#574)

2025-02-10 09:03:13 +08:00

workflow

feat: add a web UI server (#1345)

2026-03-18 14:04:52 +08:00

__init__.py

fix(security): Patch 5 CodeQL path injection and weak hashing alerts (#25-#30)

2026-04-11 21:54:27 +02:00

env.py

fix: Add Bandit security scanning and fix critical vulnerabilities

2026-04-03 11:55:05 +02:00

fmt.py

fix: fix the bug in the regular expression matching for stdout (#890)

2025-05-23 14:13:31 +08:00

prompts.yaml

fix: update fallback criterion (#1210)

2025-08-29 17:07:41 +08:00

qlib.py

feat: add a web UI server (#1345)

2026-03-18 14:04:52 +08:00