Security fix to prevent allowed_urls Filter Bypass

[udaij12]

Description

Security fix to prevent allowed_urls file:// Filter Bypass
Despite the error of Relative path is not allowed in url:, the targeted MAR file is copied from the source to the model-store folder.

Issue example:

jainudai@6cb1339aade6 serve % ls model_store/                      
densenet161.mar resnet-18.mar
jainudai@6cb1339aade6 serve % torchserve --start --model-store model_store --ncs                                                
Torchserve version: 0.10.0
TS Home: /Library/Frameworks/Python.framework/Versions/3.11/lib/python3.11/site-packages
Current directory: 
Temp directory: /var/folders/l6/xh6snvx50_v90tr7rzxhxdyr0000gr/T/
Metrics config path: /Library/Frameworks/Python.framework/Versions/3.11/lib/python3.11/site-packages/ts/configs/metrics.yaml
Number of GPUs: 16
Number of CPUs: 10
Max heap size: 8192 M
Python executable: /Library/Frameworks/Python.framework/Versions/3.11/bin/python3.11
Config file: N/A
Inference address: http://127.0.0.1:8080
Management address: http://127.0.0.1:8081
Metrics address: http://127.0.0.1:8082
Model Store: .../serve/model_store
Initial Models: N/A
Log dir: .../serve/logs
Metrics dir: .../serve/logs
Netty threads: 0
Netty client threads: 0
Default workers per model: 16
Blacklist Regex: N/A
Maximum Response Size: 6553500
Maximum Request Size: 6553500
Limit Maximum Image Pixels: true
Prefer direct buffer: false
Allowed Urls: [file://.*|http(s)?://.*]
Custom python dependency for model allowed: false
Enable metrics API: true
Metrics mode: LOG
Disable system metrics: false
Workflow Store: .../serve/model_store
CPP log config: N/A
Model config: N/A
System metrics command: default
...
Model server started.
jainudai@6cb1339aade6 serve % curl -X POST 'http://localhost:8081/models?url=file:///../Users/jainudai/Documents/Torchserve/serve/model_store_gen/alexnet.mar'

{
  "code": 404,
  "type": "ModelNotFoundException",
  "message": "Relative path is not allowed in url: file:///../Users/jainudai/Documents/Torchserve/serve/model_store_gen/alexnet.mar"
}
jainudai@6cb1339aade6 serve % ls model_store/                                                                                   
alexnet.mar     densenet161.mar resnet-18.mar

Tests

Added test to check file doesnt exist when using relative path

Logs after fix

jainudai@6cb1339aade6 serve % ls model_store/           
densenet161.mar resnet-18.mar
jainudai@6cb1339aade6 serve % torchserve --start --model-store model_store --ncs
Torchserve version: 0.10.0
TS Home: /Library/Frameworks/Python.framework/Versions/3.11/lib/python3.11/site-packages
Current directory: .../serve
Temp directory: /var/folders/l6/xh6snvx50_v90tr7rzxhxdyr0000gr/T/
Metrics config path: /Library/Frameworks/Python.framework/Versions/3.11/lib/python3.11/site-packages/ts/configs/metrics.yaml
Number of GPUs: 16
Number of CPUs: 10
Max heap size: 8192 M
Python executable: /Library/Frameworks/Python.framework/Versions/3.11/bin/python3.11
Config file: N/A
Inference address: http://127.0.0.1:8080
Management address: http://127.0.0.1:8081
Metrics address: http://127.0.0.1:8082
Model Store: .../serve/model_store
Initial Models: N/A
Log dir: .../serve/logs
Metrics dir: .../serve/logs
Netty threads: 0
Netty client threads: 0
Default workers per model: 16
Blacklist Regex: N/A
Maximum Response Size: 6553500
Maximum Request Size: 6553500
Limit Maximum Image Pixels: true
Prefer direct buffer: false
Allowed Urls: [file://.*|http(s)?://.*]
Custom python dependency for model allowed: false
Enable metrics API: true
Metrics mode: LOG
Disable system metrics: false
Workflow Store: .../serve/model_store
CPP log config: N/A
Model config: N/A
System metrics command: default
...
Model server started.
jainudai@6cb1339aade6 serve % curl -X POST 'http://localhost:8081/models?url=file:///../Users/jainudai/Documents/Torchserve/serve/model_store_gen/alexnet.mar'
{
  "code": 404,
  "type": "ModelNotFoundException",
  "message": "Relative path is not allowed in url: file:///../Users/jainudai/Documents/Torchserve/serve/model_store_gen/alexnet.mar"
}
jainudai@6cb1339aade6 serve % ls model_store/                                   
densenet161.mar resnet-18.mar

[agunapal]

@udaij12

In the PR, please add the logs of the new behavior after the fix.

[agunapal]

LGTM