Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Add trust_remote_code Parameter and Set Default to False #5819

Open
wants to merge 5 commits into
base: main
Choose a base branch
from

Conversation

yafshar
Copy link

@yafshar yafshar commented Oct 24, 2024

What does this PR do?

  • Introduced a new model parameter trust_remote_code
  • Set the default value of trust_remote_code to False to enhance security

Before submitting

- Introduced a new model parameter `trust_remote_code`
- Set the default value of `trust_remote_code` to `False`
  to enhance security
@yafshar yafshar marked this pull request as ready for review October 24, 2024 23:01
@hiyouga hiyouga added the pending This problem is yet to be addressed label Oct 25, 2024
@hohoCode
Copy link

hohoCode commented Nov 4, 2024

Can we instead set trust_remote_code to True by default? As many more advanced models are getting their own vibes these days. So we have one less thing to worry about? lol.

@yafshar
Copy link
Author

yafshar commented Nov 4, 2024

@hohoCode it is set to True, by default, but I am suggesting to remove the default behavior.
While setting trust_remote_code to True by default could simplify the process for users, it poses substantial security risks. By allowing remote code execution by default, we open the door to potential vulnerabilities, as users might inadvertently incorporate harmful or unverified code from the web. Which is very common at the moment! It’s safer to keep trust_remote_code set to False by default and encourage users to explicitly enable it only when they are confident about the source and safety of the remote code.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
pending This problem is yet to be addressed
Projects
None yet
Development

Successfully merging this pull request may close these issues.

3 participants