[JIT][Security] Do not blindly eval input string #89189
Closed
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
🔗 Helpful Links🧪 See artifacts and rendered test results at hud.pytorch.org/pr/89189
Note: Links to docs will display an error until the docs builds have been completed. ✅ No FailuresAs of commit 391e41f: This comment was automatically generated by Dr. CI and updates every 15 minutes. |
suo
approved these changes
Nov 17, 2022
Introduce `_eval_no_call` method, that evaluates statement only if it does not contain any calls(done by examining the bytecode), thus preventing command injection exploit Added simple unit test to check for that `torch.jit.annotations.get_signature` would not result in calling random code. Although, this code path exists for Python-2 compatibility, and perhaps should be simply removed.
malfet
force-pushed
the
malfet/safer-parse-type-line
branch
from
6d4013f
to
391e41f
Compare
malfet
added
topic: security
ciflow/trunk
|
@pytorchbot merge |
Merge startedYour change will be merged once all checks pass (ETA 0-4 Hours). Learn more about merging in the wiki. Questions? Feedback? Please reach out to the PyTorch DevX Team |
|
Can we push this into a release? It's is marked as |
atalman
pushed a commit
to atalman/pytorch
that referenced
this pull request
Nov 30, 2022
Introduce `_eval_no_call` method, that evaluates statement only if it does not contain any calls(done by examining the bytecode), thus preventing command injection exploit Added simple unit test to check for that `torch.jit.annotations.get_signature` would not result in calling random code. Although, this code path exists for Python-2 compatibility, and perhaps should be simply removed. Fixes pytorch#88868 Pull Request resolved: pytorch#89189 Approved by: https://github.com/suo
This was referenced Nov 30, 2022
malfet
added a commit
that referenced
this pull request
Nov 30, 2022
Introduce `_eval_no_call` method, that evaluates statement only if it does not contain any calls(done by examining the bytecode), thus preventing command injection exploit Added simple unit test to check for that `torch.jit.annotations.get_signature` would not result in calling random code. Although, this code path exists for Python-2 compatibility, and perhaps should be simply removed. Fixes #88868 Pull Request resolved: #89189 Approved by: https://github.com/suo Co-authored-by: Nikita Shulga <nshulga@meta.com>
atalman
added a commit
to atalman/pytorch
that referenced
this pull request
Nov 30, 2022
…) (pytorch#89925)" This reverts commit 74a9ca9.
18 tasks
kulinseth
pushed a commit
to kulinseth/pytorch
that referenced
this pull request
Dec 10, 2022
Introduce `_eval_no_call` method, that evaluates statement only if it does not contain any calls(done by examining the bytecode), thus preventing command injection exploit Added simple unit test to check for that `torch.jit.annotations.get_signature` would not result in calling random code. Although, this code path exists for Python-2 compatibility, and perhaps should be simply removed. Fixes pytorch#88868 Pull Request resolved: pytorch#89189 Approved by: https://github.com/suo
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Introduce
_eval_no_callmethod, that evaluates statement only if itdoes not contain any calls(done by examining the bytecode), thus preventing command injection exploit
Added simple unit test to check for that
torch.jit.annotations.get_signaturewould not result in calling randomcode.
Although, this code path exists for Python-2 compatibility, and perhaps
should be simply removed.
Fixes #88868