[diw-zw]

Fixed some security issues:

1. Use a safer approach to generate JSON strings in the llm pull CLI tool code.
2. Add validation for user-provided file paths in the benchmark dashboard handler.

[gemini-code-assist]

Code Review

This pull request enhances security by implementing input validation for experiment and file names to prevent path traversal and strengthening the path safety utility with more robust prefix checking. Additionally, it refactors metadata generation to use standard JSON marshaling instead of manual string formatting. A review comment suggests that an explicit check for '..' in the path safety function is redundant and could be removed to simplify the implementation.

[diw-zw]

@cheyang Could you please review this PR. Thanks.

[Copilot]

Pull request overview

Addresses reported security concerns by hardening JSON generation for LLM pull job metadata and adding/strengthening path validation in the benchmark dashboard HTTP handlers.

Changes:

• Replace manual JSON string construction in injectMetadataSave with json.Marshal for safer encoding.
• Add isValidName validation for experiment/file path segments in dashboard routes.
• Tighten isPathSafe with filepath.Clean and a separator-aware prefix check to reduce path traversal risk.

Reviewed changes

Copilot reviewed 3 out of 3 changed files in this pull request and generated 4 comments.

File	Description
cmd/cli/cmd/llm/pull.go	Uses structured JSON marshaling for metadata payload instead of string formatting/escaping helpers.
cmd/cli/cmd/llm/pull_test.go	Removes unit tests tied to the deleted jsonSafeString helper.
cmd/cli/cmd/llm/benchmark/dashboard/handlers.go	Adds name validation and improves path safety checks for experiment/result/image access.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[Copilot]

Pull request overview

Copilot reviewed 3 out of 3 changed files in this pull request and generated 2 comments.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[diw-zw]

@cheyang All discussions are resolved. Please review, thanks

[cheyang]

/lgtm
/approve