TPTBusiness d8ab86d6cf fix(security): replace relative_to() with realpath+startswith for CodeQL sanitization ...

Path injection (#22, #28, #29, #30):
- Switch from Path.relative_to() to os.path.realpath() + str.startswith()
  in all four path-validation sites across finetune and rl UI data_loader.py
  and finetune app.py. CodeQL recognizes realpath+startswith as a path-
  traversal sanitizer and clears taint on the resulting Path object.
- Also simplify finetune/app.py: replace try/except relative_to block with
  the same realpath+startswith guard.

Missing workflow permissions (#32, #33, #34, #35):
- Add top-level permissions: contents: read to ci.yml, docs.yml, lint.yml,
  and security.yml. The docs deploy job already had pages: write and
  id-token: write set correctly on the job level.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

2026-04-17 21:59:03 +02:00

..

ui

fix(security): replace relative_to() with realpath+startswith for CodeQL sanitization

2026-04-17 21:59:03 +02:00

conf.py

feat(rl): add AutoRL-Bench framework and benchmark integrations (#1348)

2026-03-17 15:49:30 +08:00

loop.py

feat(rl): add AutoRL-Bench framework and benchmark integrations (#1348)

2026-03-17 15:49:30 +08:00