Open A669015 opened 1 month ago
Note the weights_only=True
option of torch.load
and torch.save
seems to not be a good workaround, while bandit still found the CWE:
>> Issue: [B614:pytorch_load_save] Use of unsafe PyTorch load or save
Severity: Medium Confidence: High
CWE: CWE-502 (https://cwe.mitre.org/data/definitions/502.html)
More Info: https://bandit.readthedocs.io/en/1.7.10/plugins/b614_pytorch_load_save.html
Location: ./py4cast/datasets/base.py:574:21
573 def __post_init__(self):
574 self.stats = torch.load(self.fname, "cpu", weights_only=True)
575
--------------------------------------------------
Bandit found a CWE-502 related to
torch.load
andtorch.save
.For exemple:
The workaround in https://bandit.readthedocs.io/en/1.7.10/plugins/b614_pytorch_load_save.html proposes to replace all
torch.load
andtorch.save
unsafe usage, by thesafetensors.torch.load_file
andsafetensors.torch.save_file
from huggingface (https://huggingface.co/docs/safetensors/en/api/torch).While
safetensors.torch.load
can only load data from previoulslysafetensors.torch.save
, it will require to generate all.pt
files that are loaded in py4cast.For now, the bandit error has been deactivated in the
lint.sh
file addingB614
to the list of exceptions.