pytorch/torch/jit
Nikita Shulga 767f6aa49f [JIT][Security] Do not blindly eval input string (#89189)
Introduce `_eval_no_call` method, that evaluates statement only if it
does not contain any calls(done by examining the bytecode), thus preventing command injection exploit

Added simple unit test to check for that
`torch.jit.annotations.get_signature` would not result in calling random
code.

Although, this code path exists for Python-2 compatibility, and perhaps
should be simply removed.

Fixes https://github.com/pytorch/pytorch/issues/88868

Pull Request resolved: https://github.com/pytorch/pytorch/pull/89189
Approved by: https://github.com/suo
2022-11-17 22:05:30 +00:00
..
_passes
mobile
__init__.py
_async.py
_builtins.py Add torch.nested namespace (#84102) 2022-09-12 16:31:05 +00:00
_check.py
_dataclass_impls.py
_decomposition_utils.py
_decompositions.py
_freeze.py prepare removal of deprecated functionality in torch.testing (#87969) 2022-11-02 14:04:48 +00:00
_fuser.py add oneDNN graph fuser context API and unittest (#82491) 2022-09-12 20:09:00 +00:00
_ir_utils.py
_logging.py
_monkeytype_config.py
_pickle.py
_recursive.py [nn] module: full_backward_pre_hook (#86700) 2022-10-13 17:36:39 +00:00
_script.py Change docstring type callable to Callable for consistency (#82487) 2022-08-01 17:26:09 +00:00
_serialization.py
_shape_functions.py Move the asserts in shape functions upsample_nearest_2d op. (#85801) 2022-09-30 18:30:06 +00:00
_state.py
_trace.py Fix typos used in documents under torch directory (#88300) 2022-11-02 09:38:13 +00:00
annotations.py [JIT][Security] Do not blindly eval input string (#89189) 2022-11-17 22:05:30 +00:00
frontend.py Fix typos in messages under torch (#89049) 2022-11-17 04:18:14 +00:00
generate_bytecode.py
quantized.py [quant][ao_migration] torch.nn.quantized.dynamictorch.ao.nn.quantized.dynamic (#78714) 2022-08-25 16:50:34 +00:00
supported_ops.py
unsupported_tensor_ops.py