pytorch / pytorch/vision

Address phototour.py security vulnerability (MITM via HTTP)

Open
#8,041 2 comments 0 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

Dominant language
Python
Stars
17.9k
Forks
7.3k
Avg merge
1d 15h
Merged PRs (30d)
13

Description

🚀 The feature

Remove phototour.py to eliminate dependency on datasets hosted using HTTP instead of HTTPS.

https://github.com/pytorch/vision/blob/70a8e05a98ea8e32b98e5a09d22ab81dd3062234/torchvision/datasets/phototour.py#L37-L60

This vulnerability has been disclosed since 2020: https://github.com/418sec/huntr/pull/702

Motivation, pitch

phototour.py uses HTTP (not HTTPS) to download datasets, and is vulnerable to MITM attacks.

It may seem like a minor issue, but as tools like PyTorch become widely implemented in industry, strict security and regulatory policies come alongside. It's hard to justify allowing an easily exploitable vulnerability within a highly regulated environment.

As far back as 2018, the Chrome browser began marking websites that do not use https as "Not Secure"
https://blog.chromium.org/2018/02/a-secure-web-is-here-to-stay.html
This includes the website referenced in phototour
image

Alternatives
  1. Rehost the files elsewhere on HTTPS (or using some other method like Git LFS)
  2. Convince the administrators of matthewalunbrown.com and icvl.ee.ic.ac.uk to use HTTPS
  3. Delete phototour.py
Additional context

No response

Contributor guide

Open the contributing guide

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Research direction

Start with torchvision/datasets/phototour.py, especially lines 37-60, and inspect repository references to determine the removal scope. Done means the HTTP-based phototour dataset path is no longer part of the package and existing repository checks show no broken references.

Written by the indexing model from the issue text.

Assessment

Tech stack
python
Domain
computer-vision, security
Issue type
Bug
Difficulty
3/5
Estimated time
1-2 days
Activity status
Stale
Clarity
Clearly specified
Newbie friendliness
45/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.