diff --git a/generic/pytorch-allowed-urls.yaml b/generic/pytorch-allowed-urls.yaml new file mode 100644 index 0000000..aec642d --- /dev/null +++ b/generic/pytorch-allowed-urls.yaml @@ -0,0 +1,18 @@ +rules: + - id: pytorch-allowed-urls + message: Allowing URLs via environment variables is enabled + languages: [generic] + severity: WARNING + metadata: + category: security + subcategory: [audit] + technology: [shell] + confidence: HIGH + likelihood: MEDIUM + impact: MEDIUM + references: + - https://pytorch.org/serve/configuration.html + paths: + include: + - 'config.properties' + pattern: "use_env_allowed_urls=true" \ No newline at end of file diff --git a/generic/pytorch-auto-install-deps.yaml b/generic/pytorch-auto-install-deps.yaml new file mode 100644 index 0000000..fbb802c --- /dev/null +++ b/generic/pytorch-auto-install-deps.yaml @@ -0,0 +1,19 @@ +rules: + - id: pytorch-auto-install-deps + message: Automatic installation of model dependencies is enabled + languages: [generic] + severity: WARNING + metadata: + category: security + subcategory: [audit] + technology: [shell] + confidence: HIGH + likelihood: MEDIUM + impact: MEDIUM + references: + - https://pytorch.org/serve/configuration.html + paths: + include: + - 'config.properties' + pattern: "install_py_dep_per_model=true" +" \ No newline at end of file diff --git a/generic/pytorch-bound-to-all-interfaces.yaml b/generic/pytorch-bound-to-all-interfaces.yaml new file mode 100644 index 0000000..d989709 --- /dev/null +++ b/generic/pytorch-bound-to-all-interfaces.yaml @@ -0,0 +1,19 @@ +rules: + - id: pytorch-bound-to-all-interfaces + message: Pytorch binds to all interfaces + languages: [generic] + severity: ERROR + metadata: + category: security + subcategory: [audit] + technology: [shell] + confidence: HIGH + likelihood: MEDIUM + impact: HIGH + references: + - https://pytorch.org/serve/configuration.html + paths: + include: + - 'config.properties' + pattern-either: + - pattern-regex: (grpc_)?(inference|management|metrics)_address=https?://0\.0\.0\.0:\d+ \ No newline at end of file diff --git a/generic/pytorch-cors.yaml b/generic/pytorch-cors.yaml new file mode 100644 index 0000000..92a5bb6 --- /dev/null +++ b/generic/pytorch-cors.yaml @@ -0,0 +1,19 @@ +rules: + - id: pytorch-cors + message: CORS settings are specified but all origins are allowed + languages: [generic] + severity: WARNING + metadata: + category: security + subcategory: [audit] + technology: [shell] + confidence: HIGH + likelihood: MEDIUM + impact: MEDIUM + references: + - https://pytorch.org/serve/configuration.html + paths: + include: + - 'config.properties' + pattern-not: + - pattern: "cors_allowed_origin=*" \ No newline at end of file diff --git a/generic/pytorch-defaults-job-queue-size.yaml b/generic/pytorch-defaults-job-queue-size.yaml new file mode 100644 index 0000000..853f275 --- /dev/null +++ b/generic/pytorch-defaults-job-queue-size.yaml @@ -0,0 +1,21 @@ +rules: + - id: pytorch-defaults-job-queue-size + message: No specified job queue size in Pytorch config (default 100) + languages: [generic] + severity: WARNING + metadata: + category: security + subcategory: [audit] + technology: [shell] + confidence: HIGH + likelihood: MEDIUM + impact: MEDIUM + references: + - https://pytorch.org/serve/configuration.html + paths: + include: + - 'config.properties' + patterns: + - pattern-regex: | + (?s)(.*) + - pattern-not-regex: .*job_queue_size= \ No newline at end of file diff --git a/generic/pytorch-defaults-max-request-size.yaml b/generic/pytorch-defaults-max-request-size.yaml new file mode 100644 index 0000000..9ea8343 --- /dev/null +++ b/generic/pytorch-defaults-max-request-size.yaml @@ -0,0 +1,21 @@ +rules: + - id: pytorch-defaults-max-request-size + message: No specified maximum request size in Pytorch config + languages: [generic] + severity: WARNING + metadata: + category: security + subcategory: [audit] + technology: [shell] + confidence: HIGH + likelihood: MEDIUM + impact: MEDIUM + references: + - https://pytorch.org/serve/configuration.html + paths: + include: + - 'config.properties' + patterns: + - pattern-regex: | + (?s)(.*) + - pattern-not-regex: .*max_request_size= \ No newline at end of file diff --git a/generic/pytorch-defaults-max-response-size.yaml b/generic/pytorch-defaults-max-response-size.yaml new file mode 100644 index 0000000..307fece --- /dev/null +++ b/generic/pytorch-defaults-max-response-size.yaml @@ -0,0 +1,21 @@ +rules: + - id: pytorch-defaults-max-response-size + message: No specified maximum response size in Pytorch config + languages: [generic] + severity: WARNING + metadata: + category: security + subcategory: [audit] + technology: [shell] + confidence: HIGH + likelihood: MEDIUM + impact: MEDIUM + references: + - https://pytorch.org/serve/configuration.html + paths: + include: + - 'config.properties' + patterns: + - pattern-regex: | + (?s)(.*) + - pattern-not-regex: .*max_response_size= \ No newline at end of file diff --git a/generic/pytorch-defaults-number-of-gpu.yaml b/generic/pytorch-defaults-number-of-gpu.yaml new file mode 100644 index 0000000..4de857d --- /dev/null +++ b/generic/pytorch-defaults-number-of-gpu.yaml @@ -0,0 +1,21 @@ +rules: + - id: pytorch-defaults-number-of-gpu + message: No GPU usage limits in Pytorch config (defaults to all available) + languages: [generic] + severity: WARNING + metadata: + category: security + subcategory: [audit] + technology: [shell] + confidence: HIGH + likelihood: MEDIUM + impact: MEDIUM + references: + - https://pytorch.org/serve/configuration.html + paths: + include: + - 'config.properties' + patterns: + - pattern-regex: | + (?s)(.*) + - pattern-not-regex: .*number_of_gpu= \ No newline at end of file diff --git a/generic/pytorch-limit-max-image-pixels.yaml b/generic/pytorch-limit-max-image-pixels.yaml new file mode 100644 index 0000000..dc4d1eb --- /dev/null +++ b/generic/pytorch-limit-max-image-pixels.yaml @@ -0,0 +1,18 @@ +rules: + - id: pytorch-limit-max-image-pixels + message: Image size limit disabled in Pytorch config + languages: [generic] + severity: WARNING + metadata: + category: security + subcategory: [audit] + technology: [shell] + confidence: HIGH + likelihood: MEDIUM + impact: MEDIUM + references: + - https://pytorch.org/serve/configuration.html + paths: + include: + - 'config.properties' + pattern: "limit-max-image-pixels=false" \ No newline at end of file diff --git a/generic/pytorch-unsecured-http.yaml b/generic/pytorch-unsecured-http.yaml new file mode 100644 index 0000000..e067b7b --- /dev/null +++ b/generic/pytorch-unsecured-http.yaml @@ -0,0 +1,19 @@ +rules: + - id: pytorch-unsecured-http + message: Pytorch interface is exposed without TLS + languages: [generic] + severity: WARNING + metadata: + category: security + subcategory: [audit] + technology: [shell] + confidence: HIGH + likelihood: MEDIUM + impact: HIGH + references: + - https://pytorch.org/serve/configuration.html + paths: + include: + - 'config.properties' + pattern-either: + - pattern-regex: (grpc_)?(inference|management|metrics)_address=http:// \ No newline at end of file