TPTBusiness afe1823e85 fix(security): whitelist-validate metric column in get_top_factors (B608) ...

The metric parameter was passed directly into an f-string SQL query.
Add explicit validation against _ALLOWED_METRICS before use, raising
ValueError on unknown values. Raises ValueError on injection attempt
instead of silently accepting arbitrary column names.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

2026-04-30 07:25:14 +02:00

..

agent

feat: add a rag mcp in proposal (#1267)

2025-10-20 16:46:25 +08:00

backtesting

fix(security): whitelist-validate metric column in get_top_factors (B608)

2026-04-30 07:25:14 +02:00

benchmark

feat(rl): add AutoRL-Bench framework and benchmark integrations (#1348)

2026-03-17 15:49:30 +08:00

coder

fix(auto-fixer): replace zero \$volume with price-range proxy for FX data

2026-04-27 16:07:06 +02:00

document_reader

fix: package dependency. (#234)

2024-08-31 20:35:04 +08:00

interactor

feat: add user interaction in data science scenario (#1251)

2025-09-18 11:10:12 +08:00

knowledge_management

feat: Intelligent embedding chunking instead of truncation

2026-04-02 19:22:50 +02:00

loader

feat(backend): integrate LiteLLM API Backend (#564)

2025-02-13 15:16:18 +08:00

proposal

feat: add a web UI server (#1345)

2026-03-18 14:04:52 +08:00

runner

add feedback to workspace and ds runner base on costeer

2025-02-11 20:50:19 +08:00

workflow

feat: unified backtest engine, LLM error handling, strategy refactor

2026-04-17 22:52:07 +02:00

model_loader.py

feat: Add model loader system (same as prompts)

2026-04-02 22:40:46 +02:00

prompt_loader.py

fix(strategy): Fix template variables, APIBackend import, and JSON extraction

2026-04-12 14:47:25 +02:00