TPTBusiness 79f1d34083 fix(security): resolve path-injection and add nosec for safe temp paths (B108, py/path-injection) ...

- ds_trace.py: resolve() user-provided save path and use Path.name for filenames
  to prevent directory traversal in the local workspace save UI
- rl/finetune UI data_loaders: nosec B614 where paths are already validated
  against safe_root via realpath() before use
- Temp paths (/tmp/sample, /tmp/full, /tmp/mock/*, /tmp/predix_loop.pid,
  /tmp/autorl_output): nosec B108 — fixed Docker volume mount points or
  single-process admin files, not user-writable attack surface

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

2026-04-30 19:26:38 +02:00

..

app

fix(security): resolve path-injection and add nosec for safe temp paths (B108, py/path-injection)

2026-04-30 19:26:38 +02:00

components

fix(security): replace eval() with ast.literal_eval in finetune validator (B307)

2026-04-30 19:26:23 +02:00

core

feat: unified backtest engine, LLM error handling, strategy refactor

2026-04-17 22:52:07 +02:00

log

fix(security): resolve path-injection and add nosec for safe temp paths (B108, py/path-injection)

2026-04-30 19:26:38 +02:00

oai

fix(loop): prevent step_idx advance on unhandled exceptions + fix consecutive assistant messages

2026-04-26 21:33:24 +02:00

scenarios

fix(security): resolve path-injection and add nosec for safe temp paths (B108, py/path-injection)

2026-04-30 19:26:38 +02:00

utils

fix(security): replace shell=True subprocess calls with list args in env.py (B602)

2026-04-30 19:26:29 +02:00