Skip to content

Commit

Permalink
RAFT Fix arbitrary code execution vulnerability in checkpoint feature (
Browse files Browse the repository at this point in the history
…ShishirPatil#415)

Replaced `eval()` by `int()` when loading the checkpoint file to remove
the possibility of executing arbitrary code.

Co-authored-by: Shishir Patil <[email protected]>
  • Loading branch information
cedricvidal and ShishirPatil authored May 8, 2024
1 parent 1bdf381 commit 8d75023
Showing 1 changed file with 1 addition and 1 deletion.
2 changes: 1 addition & 1 deletion raft/raft.py
Original file line number Diff line number Diff line change
Expand Up @@ -285,7 +285,7 @@ def save_checkpoint(state, filename):

def load_checkpoint(filename):
with open(filename, 'r') as f:
return eval(f.read())
return int(f.read())

def main():
global ds
Expand Down

0 comments on commit 8d75023

Please sign in to comment.