monai-weekly 1.7.dev2636__tar.gz → 1.7.dev2638__tar.gz

{monai_weekly-1.7.dev2636 → monai_weekly-1.7.dev2638}/MANIFEST.in

@@ -1,5 +1,6 @@
 include versioneer.py
 include monai/_version.py
+include monai/config/check_env.py
 
 include README.md
 include LICENSE

{monai_weekly-1.7.dev2636 → monai_weekly-1.7.dev2638}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: monai-weekly
-Version: 1.7.dev2636
+Version: 1.7.dev2638
 Summary: AI Toolkit for Healthcare Imaging
 Author-email: MONAI Consortium <monai.contact@gmail.com>
 License: Apache License 2.0
@@ -122,6 +122,10 @@ Provides-Extra: nni
 Requires-Dist: nni; (platform_system == "Linux" and "arm" not in platform_machine and "aarch" not in platform_machine) and extra == "nni"
 Requires-Dist: filelock<3.12.0; extra == "nni"
 Requires-Dist: typeguard<3; extra == "nni"
+Provides-Extra: nvimgcodec
+Requires-Dist: pydicom; extra == "nvimgcodec"
+Requires-Dist: cupy-cuda13x[ctk]!=14.1.0; platform_system == "Linux" and extra == "nvimgcodec"
+Requires-Dist: nvidia-nvimgcodec-cu13[all]>=0.8.0; platform_system == "Linux" and extra == "nvimgcodec"
 Provides-Extra: onnx
 Requires-Dist: onnx>=1.13.0; extra == "onnx"
 Requires-Dist: onnxruntime; python_version <= "3.10" and extra == "onnx"

{monai_weekly-1.7.dev2636 → monai_weekly-1.7.dev2638}/monai/__init__.py

@@ -136,4 +136,4 @@ except Exception:
 
     if MONAIEnvVars.debug():
         raise
-__commit_id__ = "d1306f6d1996cffeb9d10984dd1c056b7fe2ed1d"
+__commit_id__ = "f2ec87ae9b536baaeca1d6bcc2b6349369e2af8f"

{monai_weekly-1.7.dev2636 → monai_weekly-1.7.dev2638}/monai/_version.py

@@ -8,11 +8,11 @@ import json
 
 version_json = '''
 {
- "date": "2026-09-06T02:14:40+0000",
+ "date": "2026-09-20T02:14:58+0000",
  "dirty": false,
  "error": null,
- "full-revisionid": "917231cf0496c0a06cc1fe4c78822d570f8a2899",
- "version": "1.7.dev2636"
+ "full-revisionid": "43b604323beaeca5718d23b2ba4c130da08d84b8",
+ "version": "1.7.dev2638"
 }
 '''  # END VERSION_JSON
 

{monai_weekly-1.7.dev2636 → monai_weekly-1.7.dev2638}/monai/apps/auto3dseg/auto_runner.py

@@ -202,7 +202,7 @@ class AutoRunner:
 
         For the datalist file format, see the description under :py:func:`monai.data.load_decathlon_datalist`.
         Note that the AutoRunner will use the "validation" key in the datalist file if it exists, otherwise
-        it will do cross-validation, by default with five folds (this is hardcoded).
+        It will do cross-validation with the configured `num_fold` number of folds (default 5).
     """
 
     analyze_params: dict | None
@@ -398,8 +398,15 @@ class AutoRunner:
         Args:
             datalist_filename: path to the datalist file.
 
+        Returns:
+            Number of existing or generated folds, or 1 when using a validation list.
+
+        Raises:
+            ValueError: If training data is missing, fold IDs are not continuous from zero,
+                or the automatic fold count is outside [2, number of training items].
+
         Notes:
-            If the fold key is not provided, it auto generates 5 folds assignments in the training key list.
+            If the fold key is not provided, it generates the configured num_fold assignments (default 5).
             If validation key list is available, then it assumes a single fold validation.
         """
 
@@ -440,7 +447,12 @@ class AutoRunner:
             num_fold = 1
 
         else:
-            num_fold = 5
+            num_fold = int(self.data_src_cfg.get("num_fold", 5))
+            if not 2 <= num_fold <= len(datalist["training"]):
+                raise ValueError(
+                    "num_fold must be at least 2 and no greater than the number of training items "
+                    "when AutoRunner generates folds."
+                )
 
             warnings.warn(
                 f"Datalist has no folds specified {datalist_filename}..."

{monai_weekly-1.7.dev2636 → monai_weekly-1.7.dev2638}/monai/apps/detection/networks/retinanet_detector.py

@@ -41,7 +41,7 @@ from __future__ import annotations
 
 import warnings
 from collections.abc import Callable, Sequence
-from typing import Any
+from typing import TYPE_CHECKING, Any
 
 import torch
 from torch import Tensor, nn
@@ -59,10 +59,13 @@ from monai.inferers import SlidingWindowInferer
 from monai.networks.nets import resnet
 from monai.utils import BlendMode, PytorchPadMode, ensure_tuple_rep, optional_import
 
-BalancedPositiveNegativeSampler, _ = optional_import(
-    "torchvision.models.detection._utils", name="BalancedPositiveNegativeSampler"
-)
-Matcher, _ = optional_import("torchvision.models.detection._utils", name="Matcher")
+if TYPE_CHECKING:
+    from torchvision.models.detection._utils import BalancedPositiveNegativeSampler, Matcher
+else:
+    BalancedPositiveNegativeSampler, _ = optional_import(
+        "torchvision.models.detection._utils", name="BalancedPositiveNegativeSampler"
+    )
+    Matcher, _ = optional_import("torchvision.models.detection._utils", name="Matcher")
 
 
 class RetinaNetDetector(nn.Module):
@@ -769,10 +772,11 @@ class RetinaNetDetector(nn.Module):
             # BELOW_LOW_THRESHOLD = -1, BETWEEN_THRESHOLDS = -2
             if isinstance(self.proposal_matcher, Matcher):
                 # if torchvision matcher
+                matcher: Matcher = self.proposal_matcher
                 match_quality_matrix = self.box_overlap_metric(
                     targets_per_image[self.target_box_key].to(anchors_per_image.device), anchors_per_image
                 )
-                matched_idxs_per_image = self.proposal_matcher(match_quality_matrix)
+                matched_idxs_per_image = matcher(match_quality_matrix)
             elif isinstance(self.proposal_matcher, ATSSMatcher):
                 # if monai ATSS matcher
                 match_quality_matrix, matched_idxs_per_image = self.proposal_matcher(

{monai_weekly-1.7.dev2636 → monai_weekly-1.7.dev2638}/monai/apps/nnunet/nnunetv2_runner.py

@@ -25,8 +25,8 @@ import monai
 from monai.apps.nnunet.utils import NNUNETMode as M
 from monai.apps.nnunet.utils import analyze_data, create_new_data_copy, create_new_dataset_json
 from monai.bundle import ConfigParser
-from monai.utils import ensure_tuple, optional_import
-from monai.utils.misc import run_cmd
+from monai.utils import ensure_tuple, optional_import, require_pkg
+from monai.utils.misc import MONAIEnvVars, run_cmd
 
 load_pickle, _ = optional_import("batchgenerators.utilities.file_and_folder_operations", name="load_pickle")
 join, _ = optional_import("batchgenerators.utilities.file_and_folder_operations", name="join")
@@ -40,6 +40,39 @@ __all__ = ["nnUNetV2Runner"]
 DATASET_ID_FORMAT = r"Dataset[0-9]{3}|[0-9]+"  # regex format for a valid nnUnet dataset name
 
 
+def _confine_to_dir(candidate: str, allowed_dir: str, description: str) -> str:
+    """
+    Resolve ``candidate`` and require that it stays inside ``allowed_dir``.
+
+    ``inference_information.json`` is produced by nnU-Net inside the results directory, but its
+    contents are plain JSON: whoever can write that file chooses the paths this runner then loads.
+    Confining the path means a tampered ``inference_information.json`` cannot redirect a load to an
+    attacker-planted file elsewhere on the filesystem.
+
+    Args:
+        candidate: the path read from the configuration file.
+        allowed_dir: the directory the path must resolve inside.
+        description: name of the field, used in the error message.
+
+    Returns:
+        The resolved absolute path.
+
+    Raises:
+        ValueError: if the resolved path escapes ``allowed_dir``.
+    """
+    resolved = os.path.realpath(candidate)
+    allowed_root = os.path.realpath(allowed_dir)
+    if os.path.commonpath([resolved, allowed_root]) != allowed_root:
+        raise ValueError(
+            f"Refusing to load {description} from '{candidate}': it resolves to '{resolved}', outside the "
+            f"expected directory '{allowed_root}'. This path is read from `inference_information.json`; a "
+            "value pointing outside the results directory indicates that file has been tampered with "
+            "(see https://github.com/Project-MONAI/MONAI/security/advisories/GHSA-8f32-8649-rv87)."
+        )
+    return resolved
+
+
+@require_pkg(pkg_name="nnunetv2")
 class nnUNetV2Runner:  # noqa: N801
     """
     ``nnUNetV2Runner`` provides an interface in MONAI to use `nnU-Net` V2 library to analyze, train, and evaluate
@@ -1004,22 +1037,38 @@ class nnUNetV2Runner:  # noqa: N801
 
         # apply postprocessing
         if run_postprocessing:
-            postprocessing_file = self.best_configuration["best_model_or_ensemble"]["postprocessing_file"]
+            results_root = os.path.join(self.nnunet_results, self.dataset_name)
+            postprocessing_file = _confine_to_dir(
+                self.best_configuration["best_model_or_ensemble"]["postprocessing_file"],
+                results_root,
+                "postprocessing_file",
+            )
+            plans_file = _confine_to_dir(
+                self.best_configuration["best_model_or_ensemble"]["some_plans_file"], results_root, "some_plans_file"
+            )
             warnings.warn(
                 f"unpickling postprocessing_file {postprocessing_file}: this path is read from "
                 "inference_information.json and is loaded with Python pickle without any allow list, "
-                "which gives whoever controls that file arbitrary code execution. Only proceed if the "
-                "inference_information.json is from a source you trust "
+                "which gives whoever controls that file arbitrary code execution. The path is confined to "
+                "the dataset's results directory, but anyone able to write inside that directory can still "
+                "supply a malicious pickle. Only proceed if the results directory is from a source you trust "
                 "(see https://github.com/Project-MONAI/MONAI/security/advisories/GHSA-8f32-8649-rv87).",
                 stacklevel=2,
             )
+            if not MONAIEnvVars.allow_pickle():
+                warnings.warn(
+                    "Loading nnU-Net postprocessing via Python pickle will require the environment variable "
+                    "MONAI_ALLOW_PICKLE=1 from MONAI 1.7. Set it now to keep this call working after the change.",
+                    FutureWarning,
+                    stacklevel=2,
+                )
             pp_fns, pp_fn_kwargs = load_pickle(postprocessing_file)
             apply_postprocessing_to_folder(
                 folder_for_pp,
                 join(target_dir_base, "ensemble_predictions_postprocessed"),
                 pp_fns,
                 pp_fn_kwargs,
-                plans_file_or_dict=self.best_configuration["best_model_or_ensemble"]["some_plans_file"],
+                plans_file_or_dict=plans_file,
             )
 
     def run(

{monai_weekly-1.7.dev2636 → monai_weekly-1.7.dev2638}/monai/apps/utils.py

@@ -378,7 +378,7 @@ def get_filename_from_url(data_url: str) -> str:
             filename = re.findall('filename="?([^";]+)"?', content_disposition)
             if filename:
                 return str(filename[0])
-        if "drive.google.com" in data_url:
+        if urlparse(data_url).netloc == "drive.google.com":
             response = requests.get(data_url)
             if "text/html" in response.headers.get("Content-Type", ""):
                 soup = BeautifulSoup(response.text, "html.parser")

{monai_weekly-1.7.dev2636 → monai_weekly-1.7.dev2638}/monai/auto3dseg/utils.py

@@ -20,6 +20,7 @@ import sys
 import warnings
 from copy import deepcopy
 from numbers import Number
+from pydoc import locate
 from typing import Any, cast
 
 import numpy as np
@@ -62,6 +63,42 @@ def _require_pickle_allowed() -> None:
         raise RuntimeError(_PICKLE_DISABLED_MSG)
 
 
+def _reject_non_algo_target(target: Any, filename: str) -> None:
+    """
+    Require that ``target`` names an ``Algo`` subclass before it is instantiated.
+
+    ``algo_from_json`` resolves ``_target_`` through ``ConfigParser``, which imports the dotted path
+    and calls it. ``algo_object.json`` has exactly one legitimate target type -- an ``Algo``
+    subclass -- so resolving the name and checking it here rejects payloads such as
+    ``subprocess.call`` or ``os.system`` before they are ever invoked.
+
+    Importing the named module still runs that module's top-level code, so this narrows the sink
+    rather than closing it: an untrusted ``algo_object.json`` combined with an attacker-controlled
+    template directory remains dangerous.
+
+    Args:
+        target: the ``_target_`` value read from the file.
+        filename: the file the value came from, used in the error message.
+
+    Raises:
+        ValueError: if ``target`` is not a string, or does not resolve to a concrete ``Algo`` subclass.
+        ModuleNotFoundError: if the module cannot be imported, so callers can try the next
+            template path.
+    """
+    if not isinstance(target, str):
+        raise ValueError(f"Invalid `_target_` in {filename}: expected a string, got {type(target).__name__}.")
+    resolved = locate(target)
+    if resolved is None:
+        raise ModuleNotFoundError(f"Cannot resolve `_target_` {target!r} from {filename}.")
+    if not (isinstance(resolved, type) and resolved is not Algo and issubclass(resolved, Algo)):
+        raise ValueError(
+            f"Refusing to instantiate `_target_` {target!r} from {filename}: it resolves to "
+            f"{resolved!r}, which is not a subclass of `monai.auto3dseg.Algo`. Only Algo subclasses "
+            "may be named in a configuration "
+            "(see https://github.com/Project-MONAI/MONAI/security/advisories/GHSA-2wx3-8x3w-r8qv)."
+        )
+
+
 measure_np, has_measure = optional_import("skimage.measure", "0.14.2", min_version)
 cp, has_cp = optional_import("cupy")
 
@@ -493,16 +530,16 @@ def algo_from_json(filename: str, template_path: PathLike | None = None, **kwarg
             if state_template_path:
                 algo_config["template_path"] = state_template_path
 
-            warnings.warn(
-                f"Loading {filename}: the file's `_target_` value is resolved to an imported callable and "
-                "invoked, and template directories from the file may be added to `sys.path`; only load "
-                "algo_object.json files from a source you trust "
-                "(see https://github.com/Project-MONAI/MONAI/security/advisories/GHSA-2wx3-8x3w-r8qv).",
-                stacklevel=2,
-            )
+            _reject_non_algo_target(target, filename)
 
             parser = ConfigParser(algo_config)
             algo = parser.get_parsed_content()
+            if not isinstance(algo, Algo):
+                raise ValueError(
+                    f"refusing to return the object built from '{target}' in {filename}: it is a "
+                    f"{type(algo).__name__}, not an Algo instance "
+                    "(see https://github.com/Project-MONAI/MONAI/security/advisories/GHSA-2wx3-8x3w-r8qv)."
+                )
             used_template_path = path
             break
         except ModuleNotFoundError as e:

{monai_weekly-1.7.dev2636 → monai_weekly-1.7.dev2638}/monai/bundle/workflows.py

@@ -11,11 +11,15 @@
 
 from __future__ import annotations
 
+import ast
+import configparser
+import io
 import json
+import logging
+import logging.handlers  # ensures `logging.handlers` is importable for the `class=` allowlist check
 import os
 import sys
 import time
-import warnings
 from abc import ABC, abstractmethod
 from collections.abc import Sequence
 from copy import copy
@@ -34,22 +38,205 @@ __all__ = ["BundleWorkflow", "ConfigWorkflow"]
 
 logger = get_logger(module_name=__name__)
 
+# `class=` values accepted in a bundle's logging INI. `fileConfig` eval()s this field, so the
+# allowlist is by module: stdlib logging handlers/formatters cover every legitimate bundle.
+_ALLOWED_LOGGING_CLASS_MODULES = {"logging", "logging.handlers"}
 
-def _warn_logging_file_execution(logging_file: str) -> None:
+
+def _reject_executable_logging_config(logging_file: str) -> str:
+    """
+    Reject a logging INI whose ``class=``/``args=`` fields would execute arbitrary code.
+
+    `logging.config.fileConfig` resolves each handler/formatter ``class=`` through ``eval()`` in a
+    namespace containing the ``logging`` module, and evaluates ``args=``/``kwargs=`` the same way.
+    A bundle ships ``configs/logging.conf`` and it is applied before any of the bundle's own config
+    is parsed, so an untrusted bundle gets code execution from the logging file alone.
+
+    Legitimate bundles only ever name stdlib logging classes, so ``class=`` is restricted to the
+    ``logging`` / ``logging.handlers`` namespaces and ``args=``/``kwargs=`` must be literals.
+
+    Args:
+        logging_file: path to the INI file that is about to be passed to `fileConfig`.
+
+    Returns:
+        The validated file content, so the caller can apply exactly this text without re-reading
+        the path (a second read could see swapped-in content and bypass this check).
+
+    Raises:
+        ValueError: if a field would run code that this allowlist does not cover.
+    """
+    try:
+        with open(logging_file, encoding="utf-8") as f:
+            content = f.read()
+    except OSError as e:
+        raise ValueError(f"cannot read logging config file {logging_file}: {e}") from e
+
+    parser = configparser.RawConfigParser()
+    try:
+        parser.read_string(content)
+    except configparser.Error as e:
+        raise ValueError(f"cannot parse logging config file {logging_file}: {e}") from e
+
+    for section in parser.sections():
+        for field in ("class", "args", "kwargs"):
+            if not parser.has_option(section, field):
+                continue
+            value = parser.get(section, field, raw=True).strip()
+            if not value:
+                continue
+            if field == "class":
+                # `fileConfig` eval()s this expression, so a bare string prefix is not a safe boundary:
+                # a call or subscript without a period (e.g. `__builtins__.eval`) would slip past it.
+                # Parse and allow only a bare name or an attribute chain whose root is allowlisted.
+                _reject_non_logging_class(value, logging_file, section)
+            else:
+                # `args`/`kwargs` are eval()ed in a namespace holding `logging`, `os` and `sys`.
+                # Literals alone are too strict -- `args=(sys.stdout,)` is the standard
+                # StreamHandler form -- so allow literals plus a fixed set of safe stream names,
+                # and reject calls, attribute traversal and comprehensions.
+                _reject_non_literal_expression(value, logging_file, section, field)
+    return content
+
+
+_ALLOWED_LOGGING_ARG_NAMES = {"sys.stdout", "sys.stderr"}
+
+
+def _is_allowed_logging_class(module: str, attribute: str) -> bool:
+    """
+    Return whether ``module.attribute`` names a logging handler or formatter class.
+
+    The check resolves the attribute on the already-imported allowlisted module and requires the
+    object to be a ``logging.Handler`` or ``logging.Formatter`` subclass. Deriving the answer from
+    the module keeps the allowlist in step with the standard library instead of hard-coding a name
+    list, and it rejects callables such as ``eval`` that are not logging classes at all.
+
+    Args:
+        module: dotted module name; must be one of ``_ALLOWED_LOGGING_CLASS_MODULES``.
+        attribute: attribute looked up on that module.
+    """
+    if module not in _ALLOWED_LOGGING_CLASS_MODULES:
+        return False
+    resolved = getattr(sys.modules.get(module), attribute, None)
+    return isinstance(resolved, type) and issubclass(resolved, (logging.Handler, logging.Formatter))
+
+
+def _reject_non_logging_class(value: str, logging_file: str, section: str) -> None:
     """
-    Warn that ``logging_file`` is about to be executed by `logging.config.fileConfig`.
+    Require ``value`` to be a bare name or an attribute chain rooted in an allowlisted module.
 
-    Called immediately before every `fileConfig` invocation in this module, so the warning is only
-    raised when the file is really executed -- not when it is missing or logging is disabled.
+    `fileConfig` passes ``class=`` to ``eval()``, so the whole expression -- not just a string
+    prefix -- must be inert. A bare identifier is resolved against the ``logging`` module; a
+    dotted path is resolved against the ``eval`` namespace. Calls, subscripts, operators and every
+    other expression node are rejected.
+
+    Args:
+        value: the raw ``class=`` value from the INI.
+        logging_file: path of the file, used in the error message.
+        section: INI section name, used in the error message.
+
+    Raises:
+        ValueError: if the expression is not a name or an attribute chain rooted in an allowlisted module.
+    """
+
+    def _fail(reason: str) -> None:
+        raise ValueError(
+            f"refusing to apply logging config {logging_file}: section [{section}] sets "
+            f"class={value!r}, which {reason} and would execute code through "
+            f"`logging.config.fileConfig`'s `eval()`. Only classes from "
+            f"{sorted(_ALLOWED_LOGGING_CLASS_MODULES)} are allowed "
+            "(see https://github.com/Project-MONAI/MONAI/security/advisories/GHSA-wvpx-5qmp-46g3)."
+        )
+
+    try:
+        tree = ast.parse(value, mode="eval")
+    except SyntaxError as e:
+        _fail(f"is not a parsable expression ({e.msg})")
+
+    node = tree.body  # type: ignore[union-attr]
+    # A bare name is resolved against the `logging` module in fileConfig's eval namespace, so it
+    # must name a real logging handler/formatter there -- `class=eval` is a bare name too, and
+    # would hand an attacker-controlled `args=` literal straight to `eval()`.
+    if isinstance(node, ast.Name):
+        if not _is_allowed_logging_class("logging", node.id):
+            _fail(f"does not name a handler or formatter in {sorted(_ALLOWED_LOGGING_CLASS_MODULES)}")
+        return
+    # An attribute chain must be rooted in an allowlisted module and end at a handler/formatter.
+    # `ast.unparse` renders the chain directly; a root that isn't a bare name (e.g. `a().b`) still
+    # can't equal a literal allowlist entry once rendered, so no separate root check is needed.
+    if isinstance(node, ast.Attribute):
+        dotted = ast.unparse(node)
+        module, _, attribute = dotted.rpartition(".")
+        if module not in _ALLOWED_LOGGING_CLASS_MODULES:
+            _fail(f"references {dotted!r}, which is not in {sorted(_ALLOWED_LOGGING_CLASS_MODULES)}")
+        if not _is_allowed_logging_class(module, attribute):
+            _fail(f"references {dotted!r}, which is not a handler or formatter class")
+        return
+    _fail("is not a name or an attribute chain")
+
+
+def _reject_non_literal_expression(value: str, logging_file: str, section: str, field: str) -> None:
+    """
+    Require ``value`` to be a literal expression, optionally naming a safe stream.
+
+    `fileConfig` evaluates ``args=``/``kwargs=`` with ``eval()``. Constants, tuples, lists, dicts
+    and sets are inert; the only non-literal forms a real logging INI needs are ``sys.stdout`` and
+    ``sys.stderr``. Everything else -- calls, subscripts, arbitrary attribute chains, comprehensions
+    -- can execute code and is rejected.
+
+    Args:
+        value: the raw field value from the INI.
+        logging_file: path of the file, used in the error message.
+        section: INI section name, used in the error message.
+        field: field name, used in the error message.
+
+    Raises:
+        ValueError: if the expression is not in the allowed subset.
+    """
+
+    def _fail(reason: str) -> None:
+        raise ValueError(
+            f"refusing to apply logging config {logging_file}: section [{section}] sets "
+            f"{field}={value!r}, which {reason} and would execute code through "
+            "`logging.config.fileConfig`'s `eval()` "
+            "(see https://github.com/Project-MONAI/MONAI/security/advisories/GHSA-wvpx-5qmp-46g3)."
+        )
+
+    try:
+        tree = ast.parse(value, mode="eval")
+    except SyntaxError as e:
+        _fail(f"is not a parsable expression ({e.msg})")
+
+    for node in ast.walk(tree.body):  # type: ignore[union-attr]
+        if isinstance(node, (ast.Constant, ast.Tuple, ast.List, ast.Dict, ast.Set, ast.Load)):
+            continue
+        if isinstance(node, (ast.Attribute, ast.Name)):
+            # `ast.unparse` renders the attribute/name chain (e.g. ``sys.stdout``) without
+            # re-walking it by hand; a chain rooted in anything but a bare name (e.g. `a().b`) is
+            # still rejected below, since it cannot equal a literal entry in the allowlist.
+            name = ast.unparse(node)
+            # Sub-nodes of an allowed chain (e.g. the `sys` of `sys.stdout`) are reached by the
+            # walk too; accept any prefix of a permitted name.
+            if name not in _ALLOWED_LOGGING_ARG_NAMES and not any(
+                allowed.startswith(f"{name}.") for allowed in _ALLOWED_LOGGING_ARG_NAMES
+            ):
+                _fail(f"references {name!r}, which is not in {sorted(_ALLOWED_LOGGING_ARG_NAMES)}")
+            continue
+        _fail(f"contains a {type(node).__name__} node")
+
+
+def _apply_logging_file(logging_file: str) -> None:
+    """
+    Validate ``logging_file`` and apply it, using exactly the content that was validated.
+
+    The single read performed by the validator is what `fileConfig` applies: re-opening the path
+    in between would let a swapped-in file bypass the allowlist and reach `fileConfig`'s `eval()`
+    calls.
+
+    Args:
+        logging_file: path to the logging INI file.
     """
-    warnings.warn(
-        f"applying logging config {logging_file}: `logging.config.fileConfig` passes the `class=` and "
-        "`args=` fields of the INI's handler and formatter sections to Python `eval()`, so this file "
-        "runs as code. A bundle ships its own `configs/logging.conf` and it is applied by default, "
-        "before any of the bundle's config is parsed. Only proceed if this file is from a source you "
-        "trust (see https://github.com/Project-MONAI/MONAI/security/advisories/GHSA-wvpx-5qmp-46g3).",
-        stacklevel=3,
-    )
+    content = _reject_executable_logging_config(logging_file)
+    fileConfig(io.StringIO(content), disable_existing_loggers=False)
 
 
 class BundleWorkflow(ABC):
@@ -74,8 +261,9 @@ class BundleWorkflow(ABC):
         logging_file: config file for `logging` module in the program. for more details:
             https://docs.python.org/3/library/logging.config.html#logging.config.fileConfig.
             Security note: `fileConfig` passes the INI's `class=` and `args=` fields to Python
-            `eval()`, so this file runs as code and applying it raises a warning -- once per call
-            site, as Python's default warning filter suppresses repeats
+            `eval()`, so this file runs as code. `class=` is restricted to the `logging` and
+            `logging.handlers` namespaces and `args=`/`kwargs=` to literals plus `sys.stdout` /
+            `sys.stderr`; anything else raises `ValueError`
             (see https://github.com/Project-MONAI/MONAI/security/advisories/GHSA-wvpx-5qmp-46g3).
 
     """
@@ -94,8 +282,7 @@ class BundleWorkflow(ABC):
             if not os.path.isfile(logging_file):
                 raise FileNotFoundError(f"Cannot find the logging config file: {logging_file}.")
             logger.info(f"Setting logging properties based on config: {logging_file}.")
-            _warn_logging_file_execution(logging_file)
-            fileConfig(logging_file, disable_existing_loggers=False)
+            _apply_logging_file(logging_file)
 
         if meta_file is not None:
             if isinstance(meta_file, str) and not os.path.isfile(meta_file):
@@ -297,8 +484,9 @@ class PythonicWorkflow(BundleWorkflow):
         logging_file: config file for `logging` module in the program. for more details:
             https://docs.python.org/3/library/logging.config.html#logging.config.fileConfig.
             Security note: `fileConfig` passes the INI's `class=` and `args=` fields to Python
-            `eval()`, so this file runs as code and applying it raises a warning -- once per call
-            site, as Python's default warning filter suppresses repeats
+            `eval()`, so this file runs as code. `class=` is restricted to the `logging` and
+            `logging.handlers` namespaces and `args=`/`kwargs=` to literals plus `sys.stdout` /
+            `sys.stderr`; anything else raises `ValueError`
             (see https://github.com/Project-MONAI/MONAI/security/advisories/GHSA-wvpx-5qmp-46g3).
 
     """
@@ -403,8 +591,9 @@ class ConfigWorkflow(BundleWorkflow):
             If None, default to "configs/logging.conf", which is commonly used for bundles in MONAI model zoo.
             If False, the logging logic for the bundle will not be modified.
             Security note: `fileConfig` passes the INI's `class=` and `args=` fields to Python
-            `eval()`, so this file runs as code and applying it raises a warning -- once per call
-            site, as Python's default warning filter suppresses repeats
+            `eval()`, so this file runs as code. `class=` is restricted to the `logging` and
+            `logging.handlers` namespaces and `args=`/`kwargs=` to literals plus `sys.stdout` /
+            `sys.stderr`; anything else raises `ValueError`
             (see https://github.com/Project-MONAI/MONAI/security/advisories/GHSA-wvpx-5qmp-46g3).
         init_id: ID name of the expected config expression to initialize before running, default to "initialize".
             allow a config to have no `initialize` logic and the ID.
@@ -475,8 +664,7 @@ class ConfigWorkflow(BundleWorkflow):
                 else:
                     raise FileNotFoundError(f"Cannot find the logging config file: {logging_file}.")
             else:
-                _warn_logging_file_execution(str(logging_file))
-                fileConfig(str(logging_file), disable_existing_loggers=False)
+                _apply_logging_file(str(logging_file))
                 logger.info(f"Setting logging properties based on config: {logging_file}.")
 
         self.parser = ConfigParser()

{monai_weekly-1.7.dev2636 → monai_weekly-1.7.dev2638}/monai/config/__init__.py

@@ -14,7 +14,6 @@ from __future__ import annotations
 from .deviceconfig import (
     USE_COMPILED,
     USE_META_DICT,
-    IgniteInfo,
     get_config_values,
     get_gpu_info,
     get_optional_config_values,

monai_weekly-1.7.dev2638/monai/config/__main__.py

@@ -0,0 +1,15 @@
+# Copyright (c) MONAI Consortium
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#     http://www.apache.org/licenses/LICENSE-2.0
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+if __name__ == "__main__":
+    import monai
+
+    monai.config.print_debug_info()  # type: ignore