TPTBusiness 848019d201 fix: Prevent path traversal in RL UI app.py ...

_safe_resolve():
- Add explicit security docstring with 6 validation steps
- Add inline comments for each security check
- Makes CodeQL recognize existing security measures

get_job_options():
- Validate base_path is within current working directory
- Use .resolve() and .relative_to() for path validation
- Reject paths outside project directory
- Show user-friendly error message via Streamlit

Fixes GitHub Security Alert #3 (py/path-injection)

Path traversal attacks via user-provided paths are now prevented.

Co-authored-by: Qwen-Coder <qwen-coder@alibabacloud.com>

2026-04-02 22:09:21 +02:00

..

benchmark

feat(backend): integrate LiteLLM API Backend (#564)

2025-02-13 15:16:18 +08:00

CI

fix mypy error (#91)

2024-07-25 15:20:04 +08:00

data_science

feat: add a web UI server (#1345)

2026-03-18 14:04:52 +08:00

finetune

fix: Prevent path traversal in get_job_options() app.py

2026-04-02 22:07:50 +02:00

general_model

chore: remove redundant tag in old scenarios (#917)

2025-06-13 17:49:58 +08:00

kaggle

feat: add option to enable hyperparameter tuning only in first eval loop (#1211)

2025-08-29 16:59:22 +08:00

qlib_rd_loop

feat: EURUSD Trading-Verbesserungen implementiert (Phase 1)

2026-03-30 19:56:26 +02:00

rl

fix: Prevent path traversal in RL UI app.py

2026-04-02 22:09:21 +02:00

utils

feat: add a web UI server (#1345)

2026-03-18 14:04:52 +08:00

cli.py

feat: Beautiful CLI dashboard + corrected start command

2026-04-02 19:21:08 +02:00