[JIT][Security] Do not blindly eval input string (#89189) #89925
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Introduce `_eval_no_call` method, that evaluates statement only if it does not contain any calls(done by examining the bytecode), thus preventing command injection exploit Added simple unit test to check for that `torch.jit.annotations.get_signature` would not result in calling random code. Although, this code path exists for Python-2 compatibility, and perhaps should be simply removed. Fixes pytorch#88868 Pull Request resolved: pytorch#89189 Approved by: https://github.com/suo
🔗 Helpful Links🧪 See artifacts and rendered test results at hud.pytorch.org/pr/89925
Note: Links to docs will display an error until the docs builds have been completed. ❌ 3 Failures, 2 PendingAs of commit 78cad99: The following jobs have failed:
This comment was automatically generated by Dr. CI and updates every 15 minutes. |
malfet
approved these changes
Nov 30, 2022
|
For the above 3 failures, 1168f42 can close the xla one. |
atalman
added a commit
to atalman/pytorch
that referenced
this pull request
Nov 30, 2022
…) (pytorch#89925)" This reverts commit 74a9ca9.
aishwaryap
pushed a commit
to alexa/teach
that referenced
this pull request
Dec 27, 2022
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Introduce
_eval_no_callmethod, that evaluates statement only if it does not contain any calls(done by examining the bytecode), thus preventing command injection exploitAdded simple unit test to check for that
torch.jit.annotations.get_signaturewould not result in calling random code.Although, this code path exists for Python-2 compatibility, and perhaps should be simply removed.
Fixes #88868
Pull Request resolved: #89189
Approved by: https://github.com/suo