Skip to content

Fix security vuls - #741

Merged
chtruong814 merged 5 commits into
mainfrom
onur/fix-sec-vul-multimodal
Sep 3, 2026
Merged

Fix security vuls#741
chtruong814 merged 5 commits into
mainfrom
onur/fix-sec-vul-multimodal

Conversation

@oyilmaz-nvidia

@oyilmaz-nvidia oyilmaz-nvidia commented Aug 7, 2026

Copy link
Copy Markdown
Contributor

No description provided.

@oyilmaz-nvidia
Fix security vuls
4069c58 
Signed-off-by: Onur Yilmaz <oyilmaz@nvidia.com>
@copy-pr-bot

copy-pr-bot Bot commented Aug 7, 2026

Copy link
Copy Markdown

This pull request requires additional validation before any workflows can run on NVIDIA's runners.

Pull request vetters can view their responsibilities here.

Contributors can view more details about this message here.

@oyilmaz-nvidia

oyilmaz-nvidia commented Aug 7, 2026

Copy link
Copy Markdown
Contributor Author

/ok to test 4069c58

@oyilmaz-nvidia
Linting issues
93cb8ce 
Signed-off-by: Onur Yilmaz <oyilmaz@nvidia.com>
@oyilmaz-nvidia

oyilmaz-nvidia commented Aug 7, 2026

Copy link
Copy Markdown
Contributor Author

/ok to test 93cb8ce

@oyilmaz-nvidia
Add copyright header
0dd42e9 
Signed-off-by: Onur Yilmaz <oyilmaz@nvidia.com>
@oyilmaz-nvidia

oyilmaz-nvidia commented Aug 7, 2026

Copy link
Copy Markdown
Contributor Author

/ok to test 0dd42e9

@chtruong814

chtruong814 commented Aug 11, 2026

Copy link
Copy Markdown
Contributor

This does not fully close the SSRF yet. validate_image_url() checks one IPv4 resolution before the fetch, but both downstream requests.get() calls re-resolve the hostname and follow redirects. A public URL that redirects to 169.254.169.254/loopback, or DNS rebinding/mixed DNS answers, can therefore bypass the check. Please make validation part of the fetch: resolve and reject all A/AAAA non-global addresses, pin the connection to the validated destination, and either disable redirects or revalidate every hop. Please add redirect, rebinding/multiple-answer, and IPv6 tests. The file:// oracle is addressed.

@oyilmaz-nvidia
Address comments
1e1113a 
Signed-off-by: Onur Yilmaz <oyilmaz@nvidia.com>
@oyilmaz-nvidia

oyilmaz-nvidia commented Aug 19, 2026

Copy link
Copy Markdown
Contributor Author

/ok to test 1e1113a

@oyilmaz-nvidia

oyilmaz-nvidia commented Aug 19, 2026

Copy link
Copy Markdown
Contributor Author

/ok to test 1e1113a

@copy-pr-bot

copy-pr-bot Bot commented Aug 19, 2026

Copy link
Copy Markdown

/ok to test 1e1113a

@oyilmaz-nvidia, there was an error processing your request: E2

See the following link for more information: https://docs.gha-runners.nvidia.com/cpr/e/2/

@chtruong814

chtruong814 commented Aug 23, 2026

Copy link
Copy Markdown
Contributor

/ok to test d559839

@chtruong814
chtruong814 merged commit 04d0c4b into main Sep 3, 2026
32 of 33 checks passed
@chtruong814
chtruong814 deleted the onur/fix-sec-vul-multimodal branch September 3, 2026 19:38
@svcnemo-autobot svcnemo-autobot mentioned this pull request Sep 3, 2026
Merged

This branch was previously deployed

3 inactive deployments
nemo-ci — d5598392 Deployed Aug 23, 2026 by copy-pr-bot[bot] via cicd-e2e-tests-trt-onnx #3024
public — d5598392 Deployed Aug 23, 2026 by copy-pr-bot[bot] via release / finalize / publish-docs #289
test — d5598392 Deployed Aug 23, 2026 by copy-pr-bot[bot] via cicd-wait-in-queue #3024
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@chtruong814 chtruong814 chtruong814 approved these changes
@athitten athitten Awaiting requested review from athitten athitten is a code owner
@pthombre pthombre Awaiting requested review from pthombre pthombre is a code owner
@meatybobby meatybobby Awaiting requested review from meatybobby meatybobby is a code owner

Assignees

No one assigned

Labels

deploy multimodal tests

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

2 participants

@oyilmaz-nvidia @chtruong814