Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

latest tqdm support #275

Open
leostre opened this issue May 15, 2024 · 0 comments
Open

latest tqdm support #275

leostre opened this issue May 15, 2024 · 0 comments

Comments

@leostre
Copy link

leostre commented May 15, 2024

Версия tqdm 4.65.2 внутри FEDOT.Industrial вызывает Security Issue:

"tqdm CLI arguments injection attack"
Impact
Any optional non-boolean CLI arguments (e.g. --delim, --buf-size, --manpath) are passed through python's eval, allowing arbitrary code execution. Example:
python -m tqdm --manpath="" + str(exec("import os\nos.system('echo hi && killall python3')")) + ""

Предложенное Dependabot обновление до 4.66.3 оказывается несовместимым с GOLEM.
Требуется расширить поддержку tqdm до более новых версий.

Ниже приведено поведение при апгрейде tqdm с помощью poetry:

_(fedot-ind-py3.10) technocreep@MacVadim examples % poetry add tqdm@4.66.3

Updating dependencies
Resolving dependencies... (3.1s)

Because no versions of fedot match >0.7.3,<0.7.3.1 || >0.7.3.1,<0.7.3.2 || >0.7.3.2,<0.8.0
and fedot (0.7.3.1) depends on thegolem (0.4.0), fedot (>0.7.3,<0.7.3.2 || >0.7.3.2,<0.8.0) requires thegolem (0.4.0).
And because fedot (0.7.3) depends on thegolem (0.4.0), fedot (>=0.7.3,<0.7.3.2 || >0.7.3.2,<0.8.0) requires thegolem (0.4.0).
And because fedot (0.7.3.2) depends on thegolem (0.4.0)
and thegolem (0.4.0) depends on tqdm (>=4.65.0,<4.66.0), fedot (>=0.7.3,<0.8.0) requires tqdm (>=4.65.0,<4.66.0).
So, because fedot-ind depends on both fedot (^0.7.3) and tqdm (4.66.3), version solving failed._

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

No branches or pull requests

1 participant