NexQuant

mirror of https://github.com/NicolasBohn/NexQuant.git synced 2026-07-27 23:47:46 +00:00

Files

T

TPTBusiness 8a3472f85a fix(security): Patch 5 CodeQL path injection and weak hashing alerts (#25-#30)

- Fix py/path-injection (Alerts #25, #28, #29, #30 - High severity):
  - Add optional safe_root parameter to get_valid_sessions() in both
    finetune/llm/ui/data_loader.py and rl/ui/data_loader.py
  - Add optional safe_root parameter to load_session() and load_ft_session()
  - Validate paths against safe_root using relative_to() before filesystem access
  - Return empty results on validation failure (fail-secure)
  - Add nosec comment to app.py:208 (path validated by _safe_resolve)

- Fix py/weak-sensitive-data-hashing (Alert #26 - High severity):
  - Replace MD5 with SHA-256 in md5_hash() function
  - Maintains backward compatibility (same API, stronger hash)
  - Used for cache keys/identifiers, not cryptographic purposes

Files:
  rdagent/app/finetune/llm/ui/data_loader.py
  rdagent/app/rl/ui/data_loader.py
  rdagent/app/rl/ui/app.py
  rdagent/utils/__init__.py

2026-04-11 21:54:27 +02:00

app

fix(security): Patch 5 CodeQL path injection and weak hashing alerts (#25-#30)

2026-04-11 21:54:27 +02:00

components

fix(security): Patch path injection and stack trace exposure (CodeQL #31 , #27 )

2026-04-11 21:50:16 +02:00

core

feat: add a web UI server (#1345 )

2026-03-18 14:04:52 +08:00

log

fix: Display litellm messages as info instead of warnings