w_lihongyan 4e75db9c23 fix: harden the profiling HTTP server against forged and out-of-tree requests ... The endpoint was reachable via GET with all parameters taken from the query string, so any web page in the operator's browser could trigger a profiling run (CSRF via <img>) with an arbitrary client-controlled output_dir, making the engine create directories and write traces anywhere the process has access to. - Accept POST + JSON body only; query parameters are no longer read and GET returns 405, which closes the browser-forgery vectors - Constrain output_dir to the DEEPINFER_TORCH_PROFILER_DIR subtree (resolved with realpath, so ../ and symlink redirections are rejected) - Bind to 127.0.0.1 by default; multi-node collection now requires an explicit DEEPINFER_PROFILE_HTTP_BIND=0.0.0.0 curl usage is unchanged: POST with a JSON body, as documented in the module docstring and the startup log line. Co-Authored-By: Kscc <noreply@owtffssent.com>		2026-10-27 15:50:05 +08:00
..
test_flops_estimator.py	initial commit	2026-10-20 12:09:42 +08:00
test_mm_overwrite_prompt.py	initial commit	2026-10-20 12:09:42 +08:00
test_profile_server.py	fix: harden the profiling HTTP server against forged and out-of-tree requests	2026-10-27 15:50:05 +08:00
test_sequence.py	initial commit	2026-10-20 12:09:42 +08:00