Marko Djordjevic 67dd7aa2f0 security: validate run_id format and add path containment check in ML service ... - Add `import re` to services/ml/app/main.py - In POST /model/load: validate run_id matches ^[a-zA-Z0-9_-]+$ before DB lookup; use Path.resolve() + directory containment check before loading model artifact - In DELETE /training/runs/{run_id}: validate run_id matches ^[a-zA-Z0-9_-]+$ before any processing; use Path.resolve() + directory containment check before deleting model artifact - Both endpoints return HTTP 400 with {"detail": "Invalid run_id format"} on invalid input - Mark task 2.2 as completed in openspec/changes/code-review-fix/tasks.md Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>		2026-02-18 11:00:19 +01:00
..
ml	security: validate run_id format and add path containment check in ML service	2026-02-18 11:00:19 +01:00