w_lihongyan 4e75db9c23 fix: harden the profiling HTTP server against forged and out-of-tree requests ... The endpoint was reachable via GET with all parameters taken from the query string, so any web page in the operator's browser could trigger a profiling run (CSRF via <img>) with an arbitrary client-controlled output_dir, making the engine create directories and write traces anywhere the process has access to. - Accept POST + JSON body only; query parameters are no longer read and GET returns 405, which closes the browser-forgery vectors - Constrain output_dir to the DEEPINFER_TORCH_PROFILER_DIR subtree (resolved with realpath, so ../ and symlink redirections are rejected) - Bind to 127.0.0.1 by default; multi-node collection now requires an explicit DEEPINFER_PROFILE_HTTP_BIND=0.0.0.0 curl usage is unchanged: POST with a JSON body, as documented in the module docstring and the startup log line. Co-Authored-By: Kscc <noreply@owtffssent.com>		2026-10-27 15:50:05 +08:00
..
_C	initial commit	2026-10-20 12:09:42 +08:00
distributed	initial commit	2026-10-20 12:09:42 +08:00
engine	fix: harden the profiling HTTP server against forged and out-of-tree requests	2026-10-27 15:50:05 +08:00
entrypoints	initial commit	2026-10-20 12:09:42 +08:00
hugging_face	initial commit	2026-10-20 12:09:42 +08:00
model_executor	initial commit	2026-10-20 12:09:42 +08:00
npu_ops	initial commit	2026-10-20 12:09:42 +08:00
structure_output	initial commit	2026-10-20 12:09:42 +08:00
ve	initial commit	2026-10-20 12:09:42 +08:00
worker	initial commit	2026-10-20 12:09:42 +08:00
__init__.py	initial commit	2026-10-20 12:09:42 +08:00
attrdict.py	initial commit	2026-10-20 12:09:42 +08:00
config.py	initial commit	2026-10-20 12:09:42 +08:00
environ.py	fix: harden the profiling HTTP server against forged and out-of-tree requests	2026-10-27 15:50:05 +08:00
load_class.py	initial commit	2026-10-20 12:09:42 +08:00
logger.py	initial commit	2026-10-20 12:09:42 +08:00
model_config_loader.py	initial commit	2026-10-20 12:09:42 +08:00
multimodal_tokens.py	initial commit	2026-10-20 12:09:42 +08:00
platform.py	initial commit	2026-10-20 12:09:42 +08:00
py.typed	initial commit	2026-10-20 12:09:42 +08:00
sampling_params.py	initial commit	2026-10-20 12:09:42 +08:00
sequence.py	initial commit	2026-10-20 12:09:42 +08:00
shared_memory.py	initial commit	2026-10-20 12:09:42 +08:00
testing.py	initial commit	2026-10-20 12:09:42 +08:00
timer.py	initial commit	2026-10-20 12:09:42 +08:00
utils.py	initial commit	2026-10-20 12:09:42 +08:00