mirror of
https://github.com/deepseek-ai/DeepInfer.git
synced 2026-10-30 15:57:20 +08:00
4e75db9c23
The endpoint was reachable via GET with all parameters taken from the query string, so any web page in the operator's browser could trigger a profiling run (CSRF via <img>) with an arbitrary client-controlled output_dir, making the engine create directories and write traces anywhere the process has access to. - Accept POST + JSON body only; query parameters are no longer read and GET returns 405, which closes the browser-forgery vectors - Constrain output_dir to the DEEPINFER_TORCH_PROFILER_DIR subtree (resolved with realpath, so ../ and symlink redirections are rejected) - Bind to 127.0.0.1 by default; multi-node collection now requires an explicit DEEPINFER_PROFILE_HTTP_BIND=0.0.0.0 curl usage is unchanged: POST with a JSON body, as documented in the module docstring and the startup log line. Co-Authored-By: Kscc <noreply@owtffssent.com>
22 lines
568 B
Plaintext
22 lines
568 B
Plaintext
-r requirements.txt
|
|
|
|
clang-format==22.1.3
|
|
execnet==2.1.2
|
|
pybind11-stubgen==2.5.5
|
|
pytest==8.4.2
|
|
pytest-xdist==3.8.0
|
|
ruff==0.15.0
|
|
|
|
# Required by the vendored submodules' stub generation (vendor/*/scripts/generate_pyi.py)
|
|
tree-sitter==0.26.0
|
|
tree-sitter-cpp==0.23.4
|
|
|
|
# Required by the sweep Pareto plotting (examples/sweep/plot_pareto.py)
|
|
matplotlib==3.11.2
|
|
|
|
# Required by the engine's runtime profiling HTTP server (deepinfer/engine/profile_server.py)
|
|
fastapi==0.128.0
|
|
uvicorn==0.40.0
|
|
# Required by fastapi.testclient (tests/engine/test_profile_server.py)
|
|
httpx==0.28.1
|