[JIT][Security] Do not blindly eval input string (#89189) #89925
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Introduce
_eval_no_call
method, that evaluates statement only if it does not contain any calls(done by examining the bytecode), thus preventing command injection exploitAdded simple unit test to check for that
torch.jit.annotations.get_signature
would not result in calling random code.Although, this code path exists for Python-2 compatibility, and perhaps should be simply removed.
Fixes #88868
Pull Request resolved: #89189
Approved by: https://github.com/suo