TPTBusiness 848019d201 fix: Prevent path traversal in RL UI app.py ...

_safe_resolve():
- Add explicit security docstring with 6 validation steps
- Add inline comments for each security check
- Makes CodeQL recognize existing security measures

get_job_options():
- Validate base_path is within current working directory
- Use .resolve() and .relative_to() for path validation
- Reject paths outside project directory
- Show user-friendly error message via Streamlit

Fixes GitHub Security Alert #3 (py/path-injection)

Path traversal attacks via user-provided paths are now prevented.

Co-authored-by: Qwen-Coder <qwen-coder@alibabacloud.com>

2026-04-02 22:09:21 +02:00

..

app

fix: Prevent path traversal in RL UI app.py

2026-04-02 22:09:21 +02:00

components

fix: Remove API key logging from eurusd_llm.py

2026-04-02 22:00:53 +02:00

core

feat: add a web UI server (#1345)

2026-03-18 14:04:52 +08:00

oai

feat: add LLM-finetune scenario (#1314)

2026-03-02 19:04:10 +08:00

scenarios

fix: Prevent path traversal in autorl_bench server.py

2026-04-02 22:02:05 +02:00

utils

feat: add a web UI server (#1345)

2026-03-18 14:04:52 +08:00