Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

updating security documentation: allowed_urls #2690

Merged
merged 3 commits into from
Oct 10, 2023
Merged

updating security documentation: allowed_urls #2690

Changes from all commits
Commits
Show all changes
3 commits
Select commit Hold shift + click to select a range
521243b
updating security documentation
agunapal Oct 9, 2023
d8268fb
review comments
agunapal Oct 10, 2023
49ffe39
Merge branch 'master' into docs/update_security_guidelines_1
agunapal Oct 10, 2023
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
2 changes: 2 additions & 0 deletions SECURITY.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -27,6 +27,8 @@ TorchServe as much as possible relies on automated tools to do security scanning
3. Be sure to validate the authenticity of the `.mar` file being used with TorchServe.
1. A `.mar` file being downloaded from the internet from an untrusted source may have malicious code, compromising the integrity of your application
2. TorchServe executes arbitrary python code packaged in the `mar` file. Make sure that you've either audited that the code you're using is safe and/or is from a source that you trust
4. By default TorchServe allows you to register models from all URLs. Make sure to set `allowed_urls` parameter in config.properties to restrict this. You can find more details in the [configuration guide](https://github.com/pytorch/serve/blob/master/docs/configuration.md#other-properties)
- `use_env_allowed_urls=true` is required in config.properties to read `allowed_urls` from environment variable



Expand Down