Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

[Security] check eval for security #61389

Merged
merged 1 commit into from
Feb 1, 2024
Merged
Show file tree
Hide file tree
Changes from all commits
Commits
File filter

Filter by extension

Filter by extension

Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
9 changes: 7 additions & 2 deletions python/paddle/distributed/fleet/base/role_maker.py
Original file line number Diff line number Diff line change
Expand Up @@ -13,6 +13,7 @@
# limitations under the License.
"""Definition of Role Makers."""
import os
import re
import time
import warnings
from multiprocessing import Manager, Process
Expand Down Expand Up @@ -988,7 +989,9 @@ def _ps_env(self): # each role will execute it
raise ValueError(
"Can not find PADDLE_STAGE_TRAINERS_NUM, please check your environment."
)
self._stage_trainers = eval(self._stage_trainers)
self._stage_trainers = tuple(
[int(x) for x in re.findall(r'\d+', self._stage_trainers)]
)
cur_port = os.getenv("PADDLE_PORT", None)
if cur_port is None:
raise ValueError(
Expand Down Expand Up @@ -1040,7 +1043,9 @@ def _ps_env(self): # each role will execute it
raise ValueError(
"Can not find PADDLE_STAGE_TRAINERS_NUM, please check your environment."
)
self._stage_trainers = eval(self._stage_trainers)
self._stage_trainers = tuple(
[int(x) for x in re.findall(r'\d+', self._stage_trainers)]
)

self._heter_trainer_device_type = os.getenv(
"HETER_DEVICE_TYPE", None
Expand Down
7 changes: 6 additions & 1 deletion python/paddle/jit/dy2static/convert_operators.py
Original file line number Diff line number Diff line change
Expand Up @@ -726,7 +726,12 @@ def convert_var_dtype(var, dtype):
}
return paddle.cast(var, dtype=cast_map[dtype])
else:
return eval(f'{dtype}(var)')
assert dtype in [
'bool',
'int',
'float',
], f"The casted target dtype is {dtype}, which is not supported in type casting."
return eval(dtype)(var)


def convert_assert(cond, message=""):
Expand Down