• ooctipus's avatar
    Disallows string value written in sb3_ppo_cfg.yaml get evaluated in process_sb3_cfg (#3110) · 81618f21
    ooctipus authored
    # Description
    
    This PR adds stricter interpretation rules to value specified in
    sb3_ppo_cfg.yaml, disallowing eval on any dict, which my contain
    arbitrary code that makes program vulnerable.
    
    Now, `eval` is got rid of, only str that start with `nn.` can be used to
    only import the module from torch.nn. That seems to cover all usage for
    lab so far, I can make more accommodations if there are more cases but
    it seems like it is currently sufficient.
    
    Fixes # (issue)
    
    <!-- As a practice, it is recommended to open an issue to have
    discussions on the proposed pull request.
    This makes it easier for the community to keep track of what is being
    developed or added, and if a given feature
    is demanded by more than one party. -->
    
    ## Type of change
    
    <!-- As you go through the list, delete the ones that are not
    applicable. -->
    
    - Bug fix (non-breaking change which fixes an issue)
    
    ## Screenshots
    
    Please attach before and after screenshots of the change if applicable.
    
    <!--
    Example:
    
    | Before | After |
    | ------ | ----- |
    | _gif/png before_ | _gif/png after_ |
    
    To upload images to a PR -- simply drag and drop an image while in edit
    mode and it should upload the image directly. You can then paste that
    source into the above before/after sections.
    -->
    
    ## Checklist
    
    - [x] I have run the [`pre-commit` checks](https://pre-commit.com/) with
    `./isaaclab.sh --format`
    - [ ] I have made corresponding changes to the documentation
    - [x] My changes generate no new warnings
    - [ ] I have added tests that prove my fix is effective or that my
    feature works
    - [x] I have updated the changelog and the corresponding version in the
    extension's `config/extension.toml` file
    - [x] I have added my name to the `CONTRIBUTORS.md` or my name already
    exists there
    
    <!--
    As you go through the checklist above, you can mark something as done by
    putting an x character in it
    
    For example,
    - [x] I have done this task
    - [ ] I have not done this task
    -->
    
    ---------
    Signed-off-by: 's avatarooctipus <zhengyuz@nvidia.com>
    Co-authored-by: 's avatarMayank Mittal <12863862+Mayankm96@users.noreply.github.com>
    Co-authored-by: 's avatarKelly Guo <kellyg@nvidia.com>
    81618f21
Name
Last commit
Last update
..
config Loading commit data...
docs Loading commit data...
isaaclab_tasks Loading commit data...
test Loading commit data...
pyproject.toml Loading commit data...
setup.py Loading commit data...