Address phototour.py security vulnerability (MITM via HTTP)
Nobody has claimed this yet.
- Dominant language
- Python
- Stars
- 17.9k
- Forks
- 7.3k
- Avg merge
- 1d 15h
- Merged PRs (30d)
- 13
Description
🚀 The feature
Remove phototour.py to eliminate dependency on datasets hosted using HTTP instead of HTTPS.
This vulnerability has been disclosed since 2020: https://github.com/418sec/huntr/pull/702
Motivation, pitch
phototour.py uses HTTP (not HTTPS) to download datasets, and is vulnerable to MITM attacks.
It may seem like a minor issue, but as tools like PyTorch become widely implemented in industry, strict security and regulatory policies come alongside. It's hard to justify allowing an easily exploitable vulnerability within a highly regulated environment.
As far back as 2018, the Chrome browser began marking websites that do not use https as "Not Secure"
https://blog.chromium.org/2018/02/a-secure-web-is-here-to-stay.html
This includes the website referenced in phototour
Alternatives
- Rehost the files elsewhere on HTTPS (or using some other method like Git LFS)
- Convince the administrators of matthewalunbrown.com and icvl.ee.ic.ac.uk to use HTTPS
- Delete phototour.py
Additional context
No response
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Start with torchvision/datasets/phototour.py, especially lines 37-60, and inspect repository references to determine the removal scope. Done means the HTTP-based phototour dataset path is no longer part of the package and existing repository checks show no broken references.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- python
- Domain
- computer-vision, security
- Issue type
- Bug
- Difficulty
- 3/5
- Estimated time
- 1-2 days
- Activity status
- Stale
- Clarity
- Clearly specified
- Newbie friendliness
- 45/100