Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

[JIT][Security] Do not blindly eval input string (#89189) #89925

Merged
merged 1 commit into from Nov 30, 2022
Merged

[JIT][Security] Do not blindly eval input string (#89189) #89925

merged 1 commit into from Nov 30, 2022

Commits on Nov 30, 2022

  1. [JIT][Security] Do not blindly eval input string (pytorch#89189) 

    Introduce `_eval_no_call` method, that evaluates statement only if it
does not contain any calls(done by examining the bytecode), thus preventing command injection exploit

Added simple unit test to check for that
`torch.jit.annotations.get_signature` would not result in calling random
code.

Although, this code path exists for Python-2 compatibility, and perhaps
should be simply removed.

Fixes pytorch#88868

Pull Request resolved: pytorch#89189
Approved by: https://github.com/suo
    @malfet @atalman
    malfet authored and atalman committed Nov 30, 2022
    Configuration menu
    Copy the full SHA
    78cad99 View commit details
    Browse the repository at this point in the history