From e0601e1b945d3e2beb2d6fdd2099f4fe89a110f8 Mon Sep 17 00:00:00 2001 From: Alexander Matveev Date: Mon, 15 Jun 2026 14:12:26 -0400 Subject: [PATCH] Address review: bind test sockets to localhost instead of all interfaces Fix CodeQL security warning by binding test helper sockets to "localhost" instead of "" (all interfaces). These sockets are only used for finding a free port for torch distributed init in tests. Co-Authored-By: Claude Opus 4.6 (1M context) Signed-off-by: Alexander Matveev --- tests/distributed/_test_push_ar_worker.py | 2 +- tests/distributed/test_push_all_reduce.py | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/tests/distributed/_test_push_ar_worker.py b/tests/distributed/_test_push_ar_worker.py index c92c7bf03bc..14bc6ba4f46 100644 --- a/tests/distributed/_test_push_ar_worker.py +++ b/tests/distributed/_test_push_ar_worker.py @@ -19,7 +19,7 @@ import torch.distributed as dist def find_free_port() -> int: """Find a free TCP port for distributed init.""" with socket.socket(socket.AF_INET, socket.SOCK_STREAM) as s: - s.bind(("", 0)) + s.bind(("localhost", 0)) return s.getsockname()[1] diff --git a/tests/distributed/test_push_all_reduce.py b/tests/distributed/test_push_all_reduce.py index 9689c5e1000..8d97e094652 100644 --- a/tests/distributed/test_push_all_reduce.py +++ b/tests/distributed/test_push_all_reduce.py @@ -51,7 +51,7 @@ def _find_free_port() -> int: import socket with socket.socket(socket.AF_INET, socket.SOCK_STREAM) as s: - s.bind(("", 0)) + s.bind(("localhost", 0)) return s.getsockname()[1]