gavindiaz/NexQuant
1
0
Fork 0
mirror of https://github.com/NicolasBohn/NexQuant.git synced 2026-07-30 00:47:43 +00:00
Code Issues Packages Projects Releases Wiki Activity

fix(security): resolve all 30 Bandit security alerts (B301, B614, B104)

Browse Source 
- B301 (pickle): add nosec B301 to pd.read_pickle calls in Kaggle templates
  — files are trusted Kaggle-environment inputs, not user-supplied
- B614 (torch.load): add weights_only=True to all torch.load calls in
  model benchmark GT code and gt_code.py
- B104 (binding 0.0.0.0): change run_server and CLI default to 127.0.0.1;
  add nosec comment where all-interface binding is required for Docker

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
This commit is contained in:
TPTBusiness
2026-04-21 22:19:06 +02:00
parent 805e6d6a1d
commit fac35dfd48
11 changed files with 34 additions and 34 deletions
Download Patch File Download Diff File Expand all files Collapse all files
rdagent/components/coder/model_coder/benchmark/gt_code/A-DGN.py
+2 -2
View File
@@ -123,8 +123,8 @@ model_cls = AntiSymmetricConv
if __name__ == "__main__":
node_features = torch.load("node_features.pt")
edge_index = torch.load("edge_index.pt")
node_features = torch.load("node_features.pt", weights_only=True)
edge_index = torch.load("edge_index.pt", weights_only=True)
# Model instantiation and forward pass
model = AntiSymmetricConv(in_channels=node_features.size(-1))
rdagent/components/coder/model_coder/benchmark/gt_code/dirgnn.py
+2 -2
View File
@@ -78,8 +78,8 @@ model_cls = DirGNNConv
if __name__ == "__main__":
node_features = torch.load("node_features.pt")
edge_index = torch.load("edge_index.pt")
node_features = torch.load("node_features.pt", weights_only=True)
edge_index = torch.load("edge_index.pt", weights_only=True)
# Model instantiation and forward pass
model = DirGNNConv(MessagePassing())
rdagent/components/coder/model_coder/benchmark/gt_code/gpsconv.py
+2 -2
View File
@@ -187,8 +187,8 @@ model_cls = GPSConv
if __name__ == "__main__":
node_features = torch.load("node_features.pt")
edge_index = torch.load("edge_index.pt")
node_features = torch.load("node_features.pt", weights_only=True)
edge_index = torch.load("edge_index.pt", weights_only=True)
# Model instantiation and forward pass
model = GPSConv(channels=node_features.size(-1), conv=MessagePassing())
rdagent/components/coder/model_coder/benchmark/gt_code/linkx.py
+2 -2
View File
@@ -170,8 +170,8 @@ class LINKX(torch.nn.Module):
model_cls = LINKX
if __name__ == "__main__":
node_features = torch.load("node_features.pt")
edge_index = torch.load("edge_index.pt")
node_features = torch.load("node_features.pt", weights_only=True)
edge_index = torch.load("edge_index.pt", weights_only=True)
# Model instantiation and forward pass
model = LINKX(
rdagent/components/coder/model_coder/benchmark/gt_code/pmlp.py
+2 -2
View File
@@ -102,8 +102,8 @@ class PMLP(torch.nn.Module):
model_cls = PMLP
if __name__ == "__main__":
node_features = torch.load("node_features.pt")
edge_index = torch.load("edge_index.pt")
node_features = torch.load("node_features.pt", weights_only=True)
edge_index = torch.load("edge_index.pt", weights_only=True)
# Model instantiation and forward pass
model = PMLP(
rdagent/components/coder/model_coder/benchmark/gt_code/visnet.py
+2 -2
View File
@@ -1180,8 +1180,8 @@ model_cls = ViSNet
if __name__ == "__main__":
node_features = torch.load("node_features.pt")
edge_index = torch.load("edge_index.pt")
node_features = torch.load("node_features.pt", weights_only=True)
edge_index = torch.load("edge_index.pt", weights_only=True)
# Model instantiation and forward pass
model = ViSNet()
rdagent/components/coder/model_coder/gt_code.py
+2 -2
View File
@@ -125,8 +125,8 @@ class AntiSymmetricConv(torch.nn.Module):
if __name__ == "__main__":
node_features = torch.load("node_features.pt")
edge_index = torch.load("edge_index.pt")
node_features = torch.load("node_features.pt", weights_only=True)
edge_index = torch.load("edge_index.pt", weights_only=True)
# Model instantiation and forward pass
model = AntiSymmetricConv(in_channels=node_features.size(-1))
rdagent/scenarios/kaggle/experiment/templates/meta_tpl_deprecated/fea_share_preprocess.py
+6 -6
View File
@@ -85,12 +85,12 @@ def preprocess_script():
This method applies the preprocessing steps to the training, validation, and test datasets.
"""
if os.path.exists("/kaggle/input/X_train.pkl"):
X_train = pd.read_pickle("/kaggle/input/X_train.pkl")
X_valid = pd.read_pickle("/kaggle/input/X_valid.pkl")
y_train = pd.read_pickle("/kaggle/input/y_train.pkl")
y_valid = pd.read_pickle("/kaggle/input/y_valid.pkl")
X_test = pd.read_pickle("/kaggle/input/X_test.pkl")
others = pd.read_pickle("/kaggle/input/others.pkl")
X_train = pd.read_pickle("/kaggle/input/X_train.pkl") # nosec B301
X_valid = pd.read_pickle("/kaggle/input/X_valid.pkl") # nosec B301
y_train = pd.read_pickle("/kaggle/input/y_train.pkl") # nosec B301
y_valid = pd.read_pickle("/kaggle/input/y_valid.pkl") # nosec B301
X_test = pd.read_pickle("/kaggle/input/X_test.pkl") # nosec B301
others = pd.read_pickle("/kaggle/input/others.pkl") # nosec B301
return X_train, X_valid, y_train, y_valid, X_test, *others
X_train, X_valid, y_train, y_valid = prepreprocess()
rdagent/scenarios/kaggle/experiment/templates/playground-series-s3e26/fea_share_preprocess.py
+5 -5
View File
@@ -82,11 +82,11 @@ def preprocess_script():
This method applies the preprocessing steps to the training, validation, and test datasets.
"""
if os.path.exists("X_train.pkl"):
X_train = pd.read_pickle("X_train.pkl")
X_valid = pd.read_pickle("X_valid.pkl")
y_train = pd.read_pickle("y_train.pkl")
y_valid = pd.read_pickle("y_valid.pkl")
X_test = pd.read_pickle("X_test.pkl")
X_train = pd.read_pickle("X_train.pkl") # nosec B301
X_valid = pd.read_pickle("X_valid.pkl") # nosec B301
y_train = pd.read_pickle("y_train.pkl") # nosec B301
y_valid = pd.read_pickle("y_valid.pkl") # nosec B301
X_test = pd.read_pickle("X_test.pkl") # nosec B301
return X_train, X_valid, y_train, y_valid, X_test
X_train, X_valid, y_train, y_valid, test, status_encoder, test_ids = prepreprocess()
rdagent/scenarios/kaggle/experiment/templates/playground-series-s4e8/fea_share_preprocess.py
+6 -6
View File
@@ -73,12 +73,12 @@ def preprocess_script():
This method applies the preprocessing steps to the training, validation, and test datasets.
"""
if os.path.exists("/kaggle/input/X_train.pkl"):
X_train = pd.read_pickle("/kaggle/input/X_train.pkl")
X_valid = pd.read_pickle("/kaggle/input/X_valid.pkl")
y_train = pd.read_pickle("/kaggle/input/y_train.pkl")
y_valid = pd.read_pickle("/kaggle/input/y_valid.pkl")
X_test = pd.read_pickle("/kaggle/input/X_test.pkl")
others = pd.read_pickle("/kaggle/input/others.pkl")
X_train = pd.read_pickle("/kaggle/input/X_train.pkl") # nosec B301
X_valid = pd.read_pickle("/kaggle/input/X_valid.pkl") # nosec B301
y_train = pd.read_pickle("/kaggle/input/y_train.pkl") # nosec B301
y_valid = pd.read_pickle("/kaggle/input/y_valid.pkl") # nosec B301
X_test = pd.read_pickle("/kaggle/input/X_test.pkl") # nosec B301
others = pd.read_pickle("/kaggle/input/others.pkl") # nosec B301
y_train = pd.Series(y_train).reset_index(drop=True)
y_valid = pd.Series(y_valid).reset_index(drop=True)
rdagent/scenarios/rl/autorl_bench/core/server.py
+3 -3
View File
@@ -391,7 +391,7 @@ def set_baseline():
return jsonify({"baseline_score": score, "status": "set"})
def run_server(task: str, base_model: str, workspace: str, host: str = "0.0.0.0", port: int = 5000):
def run_server(task: str, base_model: str, workspace: str, host: str = "127.0.0.1", port: int = 5000):
"""启动服务器"""
init_server(task, base_model, workspace)
logger.info(f"Grading Server | task={task} | {host}:{port}")
@@ -435,7 +435,7 @@ class LocalServerContext(GradingServerContext):
logger.info(f"[Local Mode] Starting evaluation server on port {self.port}...")
self.server = init_server(self.task, self.base_model, self.workspace)
self._http_server = make_server("0.0.0.0", self.port, app, threaded=True)
self._http_server = make_server("0.0.0.0", self.port, app, threaded=True) # nosec B104 — intentional: Docker sandbox requires all-interface binding
self._thread = threading.Thread(target=self._http_server.serve_forever, daemon=True)
self._thread.start()
@@ -488,7 +488,7 @@ if __name__ == "__main__":
parser.add_argument("--base-model", type=str, default="")
parser.add_argument("--workspace", type=str, default=".")
parser.add_argument("--port", type=int, default=5000)
parser.add_argument("--host", type=str, default="0.0.0.0")
parser.add_argument("--host", type=str, default="127.0.0.1")
args = parser.parse_args()
run_server(args.task, args.base_model, args.workspace, args.host, args.port)