TPTBusiness 9d623f0fbb fix(security): resolve CodeQL path-injection alerts in UI data loaders ...

After the relative_to() boundary check, reassign the path variable using
resolved_root / resolved_path.relative_to(resolved_root) so all subsequent
file operations use a path derived from the trusted application root rather
than the original user-supplied value. This breaks CodeQL's taint chain
(py/path-injection) while preserving identical runtime behaviour.

Fixes alerts #41, #42, #43, #44.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

2026-04-17 21:49:30 +02:00

..

app

fix(security): resolve CodeQL path-injection alerts in UI data loaders

2026-04-17 21:49:30 +02:00

components

feat: add daily log rotation, llama health wait, factor auto-fixer, and README updates

2026-04-16 07:20:08 +02:00

core

feat: add a web UI server (#1345)

2026-03-18 14:04:52 +08:00

log

feat(logging): write complete LLM prompts and responses to daily JSONL log

2026-04-17 21:46:28 +02:00

oai

feat(logging): write complete LLM prompts and responses to daily JSONL log

2026-04-17 21:46:28 +02:00

scenarios

feat(factor-coder): Add critical rules to prevent common factor implementation errors

2026-04-13 15:28:21 +02:00

utils

fix(security): Patch 5 CodeQL path injection and weak hashing alerts (#25-#30)

2026-04-11 21:54:27 +02:00