From 8727fec9a3dddbb6e3a8f339d17ec244a571e069 Mon Sep 17 00:00:00 2001 From: GrosQuildu Date: Mon, 8 Jul 2024 10:02:55 +0200 Subject: [PATCH] Revert "Add rules for pytorch config best practices" This reverts commit 2d82231cd5caaabe4061db563135e15855dd4028. --- generic/pytorch-allowed-urls.yaml | 18 ---------------- generic/pytorch-auto-install-deps.yaml | 19 ----------------- generic/pytorch-bound-to-all-interfaces.yaml | 19 ----------------- generic/pytorch-cors.yaml | 19 ----------------- generic/pytorch-defaults-job-queue-size.yaml | 21 ------------------- .../pytorch-defaults-max-request-size.yaml | 21 ------------------- .../pytorch-defaults-max-response-size.yaml | 21 ------------------- generic/pytorch-defaults-number-of-gpu.yaml | 21 ------------------- generic/pytorch-limit-max-image-pixels.yaml | 18 ---------------- generic/pytorch-unsecured-http.yaml | 19 ----------------- 10 files changed, 196 deletions(-) delete mode 100644 generic/pytorch-allowed-urls.yaml delete mode 100644 generic/pytorch-auto-install-deps.yaml delete mode 100644 generic/pytorch-bound-to-all-interfaces.yaml delete mode 100644 generic/pytorch-cors.yaml delete mode 100644 generic/pytorch-defaults-job-queue-size.yaml delete mode 100644 generic/pytorch-defaults-max-request-size.yaml delete mode 100644 generic/pytorch-defaults-max-response-size.yaml delete mode 100644 generic/pytorch-defaults-number-of-gpu.yaml delete mode 100644 generic/pytorch-limit-max-image-pixels.yaml delete mode 100644 generic/pytorch-unsecured-http.yaml diff --git a/generic/pytorch-allowed-urls.yaml b/generic/pytorch-allowed-urls.yaml deleted file mode 100644 index aec642d..0000000 --- a/generic/pytorch-allowed-urls.yaml +++ /dev/null @@ -1,18 +0,0 @@ -rules: - - id: pytorch-allowed-urls - message: Allowing URLs via environment variables is enabled - languages: [generic] - severity: WARNING - metadata: - category: security - subcategory: [audit] - technology: [shell] - confidence: HIGH - likelihood: MEDIUM - impact: MEDIUM - references: - - https://pytorch.org/serve/configuration.html - paths: - include: - - 'config.properties' - pattern: "use_env_allowed_urls=true" \ No newline at end of file diff --git a/generic/pytorch-auto-install-deps.yaml b/generic/pytorch-auto-install-deps.yaml deleted file mode 100644 index fbb802c..0000000 --- a/generic/pytorch-auto-install-deps.yaml +++ /dev/null @@ -1,19 +0,0 @@ -rules: - - id: pytorch-auto-install-deps - message: Automatic installation of model dependencies is enabled - languages: [generic] - severity: WARNING - metadata: - category: security - subcategory: [audit] - technology: [shell] - confidence: HIGH - likelihood: MEDIUM - impact: MEDIUM - references: - - https://pytorch.org/serve/configuration.html - paths: - include: - - 'config.properties' - pattern: "install_py_dep_per_model=true" -" \ No newline at end of file diff --git a/generic/pytorch-bound-to-all-interfaces.yaml b/generic/pytorch-bound-to-all-interfaces.yaml deleted file mode 100644 index d989709..0000000 --- a/generic/pytorch-bound-to-all-interfaces.yaml +++ /dev/null @@ -1,19 +0,0 @@ -rules: - - id: pytorch-bound-to-all-interfaces - message: Pytorch binds to all interfaces - languages: [generic] - severity: ERROR - metadata: - category: security - subcategory: [audit] - technology: [shell] - confidence: HIGH - likelihood: MEDIUM - impact: HIGH - references: - - https://pytorch.org/serve/configuration.html - paths: - include: - - 'config.properties' - pattern-either: - - pattern-regex: (grpc_)?(inference|management|metrics)_address=https?://0\.0\.0\.0:\d+ \ No newline at end of file diff --git a/generic/pytorch-cors.yaml b/generic/pytorch-cors.yaml deleted file mode 100644 index 92a5bb6..0000000 --- a/generic/pytorch-cors.yaml +++ /dev/null @@ -1,19 +0,0 @@ -rules: - - id: pytorch-cors - message: CORS settings are specified but all origins are allowed - languages: [generic] - severity: WARNING - metadata: - category: security - subcategory: [audit] - technology: [shell] - confidence: HIGH - likelihood: MEDIUM - impact: MEDIUM - references: - - https://pytorch.org/serve/configuration.html - paths: - include: - - 'config.properties' - pattern-not: - - pattern: "cors_allowed_origin=*" \ No newline at end of file diff --git a/generic/pytorch-defaults-job-queue-size.yaml b/generic/pytorch-defaults-job-queue-size.yaml deleted file mode 100644 index 853f275..0000000 --- a/generic/pytorch-defaults-job-queue-size.yaml +++ /dev/null @@ -1,21 +0,0 @@ -rules: - - id: pytorch-defaults-job-queue-size - message: No specified job queue size in Pytorch config (default 100) - languages: [generic] - severity: WARNING - metadata: - category: security - subcategory: [audit] - technology: [shell] - confidence: HIGH - likelihood: MEDIUM - impact: MEDIUM - references: - - https://pytorch.org/serve/configuration.html - paths: - include: - - 'config.properties' - patterns: - - pattern-regex: | - (?s)(.*) - - pattern-not-regex: .*job_queue_size= \ No newline at end of file diff --git a/generic/pytorch-defaults-max-request-size.yaml b/generic/pytorch-defaults-max-request-size.yaml deleted file mode 100644 index 9ea8343..0000000 --- a/generic/pytorch-defaults-max-request-size.yaml +++ /dev/null @@ -1,21 +0,0 @@ -rules: - - id: pytorch-defaults-max-request-size - message: No specified maximum request size in Pytorch config - languages: [generic] - severity: WARNING - metadata: - category: security - subcategory: [audit] - technology: [shell] - confidence: HIGH - likelihood: MEDIUM - impact: MEDIUM - references: - - https://pytorch.org/serve/configuration.html - paths: - include: - - 'config.properties' - patterns: - - pattern-regex: | - (?s)(.*) - - pattern-not-regex: .*max_request_size= \ No newline at end of file diff --git a/generic/pytorch-defaults-max-response-size.yaml b/generic/pytorch-defaults-max-response-size.yaml deleted file mode 100644 index 307fece..0000000 --- a/generic/pytorch-defaults-max-response-size.yaml +++ /dev/null @@ -1,21 +0,0 @@ -rules: - - id: pytorch-defaults-max-response-size - message: No specified maximum response size in Pytorch config - languages: [generic] - severity: WARNING - metadata: - category: security - subcategory: [audit] - technology: [shell] - confidence: HIGH - likelihood: MEDIUM - impact: MEDIUM - references: - - https://pytorch.org/serve/configuration.html - paths: - include: - - 'config.properties' - patterns: - - pattern-regex: | - (?s)(.*) - - pattern-not-regex: .*max_response_size= \ No newline at end of file diff --git a/generic/pytorch-defaults-number-of-gpu.yaml b/generic/pytorch-defaults-number-of-gpu.yaml deleted file mode 100644 index 4de857d..0000000 --- a/generic/pytorch-defaults-number-of-gpu.yaml +++ /dev/null @@ -1,21 +0,0 @@ -rules: - - id: pytorch-defaults-number-of-gpu - message: No GPU usage limits in Pytorch config (defaults to all available) - languages: [generic] - severity: WARNING - metadata: - category: security - subcategory: [audit] - technology: [shell] - confidence: HIGH - likelihood: MEDIUM - impact: MEDIUM - references: - - https://pytorch.org/serve/configuration.html - paths: - include: - - 'config.properties' - patterns: - - pattern-regex: | - (?s)(.*) - - pattern-not-regex: .*number_of_gpu= \ No newline at end of file diff --git a/generic/pytorch-limit-max-image-pixels.yaml b/generic/pytorch-limit-max-image-pixels.yaml deleted file mode 100644 index dc4d1eb..0000000 --- a/generic/pytorch-limit-max-image-pixels.yaml +++ /dev/null @@ -1,18 +0,0 @@ -rules: - - id: pytorch-limit-max-image-pixels - message: Image size limit disabled in Pytorch config - languages: [generic] - severity: WARNING - metadata: - category: security - subcategory: [audit] - technology: [shell] - confidence: HIGH - likelihood: MEDIUM - impact: MEDIUM - references: - - https://pytorch.org/serve/configuration.html - paths: - include: - - 'config.properties' - pattern: "limit-max-image-pixels=false" \ No newline at end of file diff --git a/generic/pytorch-unsecured-http.yaml b/generic/pytorch-unsecured-http.yaml deleted file mode 100644 index e067b7b..0000000 --- a/generic/pytorch-unsecured-http.yaml +++ /dev/null @@ -1,19 +0,0 @@ -rules: - - id: pytorch-unsecured-http - message: Pytorch interface is exposed without TLS - languages: [generic] - severity: WARNING - metadata: - category: security - subcategory: [audit] - technology: [shell] - confidence: HIGH - likelihood: MEDIUM - impact: HIGH - references: - - https://pytorch.org/serve/configuration.html - paths: - include: - - 'config.properties' - pattern-either: - - pattern-regex: (grpc_)?(inference|management|metrics)_address=http:// \ No newline at end of file