-
Notifications
You must be signed in to change notification settings - Fork 457
Adds a new task to detect CSAM using an external provider #2815
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
base: master
Are you sure you want to change the base?
Changes from all commits
9404edb
a86f327
18e3c68
477407e
File filter
Filter by extension
Conversations
Jump to
Diff view
Diff view
There are no files selected for viewing
| Original file line number | Diff line number | Diff line change | ||||||
|---|---|---|---|---|---|---|---|---|
| @@ -0,0 +1,25 @@ | ||||||||
| ########################################## | ||||||||
| # RemoteImageExternalClassifier Task configuration | ||||||||
| ########################################## | ||||||||
|
|
||||||||
| # URL of the service/central node used by the RemoteImageExternalClassifier implementation | ||||||||
| url = http://localhost:8000 | ||||||||
|
||||||||
| url = http://localhost:8000 | |
| # For any non-local deployment, this endpoint MUST use HTTPS/TLS. | |
| url = https://localhost:8000 |
Copilot
AI
Mar 3, 2026
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Setting validateSSL = false by default disables TLS certificate and hostname validation in RemoteImageExternalClassifierTask.getClient(), which relies on a trust-all TrustStrategy and NoopHostnameVerifier. This allows any host with a spoofed certificate on the network path to impersonate the classifier service and read or alter the evidence ZIP; make this flag default to true and avoid using the trust-all branch outside tightly controlled testing.
| validateSSL = false | |
| validateSSL = true |
| Original file line number | Diff line number | Diff line change | ||||
|---|---|---|---|---|---|---|
| @@ -0,0 +1,137 @@ | ||||||
| package iped.engine.config; | ||||||
|
|
||||||
| import iped.utils.UTF8Properties; | ||||||
|
|
||||||
| public class RemoteImageExternalClassifierConfig extends AbstractTaskPropertiesConfig { | ||||||
|
|
||||||
| private static final long serialVersionUID = 1L; | ||||||
|
|
||||||
| /** | ||||||
| * Config file name and enable/disable property. | ||||||
| */ | ||||||
| private static final String CONFIG_FILE = "RemoteImageExternalClassifierConfig.txt"; | ||||||
| private static final String ENABLE_PROP = "enableRemoteImageExternalClassifier"; | ||||||
|
|
||||||
| /** | ||||||
| * Constants mapping to properties name in config file. | ||||||
| */ | ||||||
| private static final String URL = "url"; | ||||||
| private static final String BATCH_SIZE = "batchSize"; | ||||||
| private static final String LABELING_THRESHOLD = "labelingThreshold"; | ||||||
| private static final String SKIP_SIZE = "skipSize"; | ||||||
| private static final String SKIP_DIMENSION = "skipDimension"; | ||||||
| private static final String SKIP_HASH_DB_FILES = "skipHashDBFiles"; | ||||||
| private static final String VALIDATE_SSL = "validateSSL"; | ||||||
|
|
||||||
| // URL of the service/central node used by the RemoteImageClassifier implementation | ||||||
| private String url; | ||||||
|
|
||||||
| // Maximum number of thumbs to be included in the zip file to send to the server | ||||||
| private int batchSize = 50; | ||||||
|
|
||||||
| // Threshold used to decide if an image is labeled with one class | ||||||
| private double labelingThreshold = 60; | ||||||
|
|
||||||
| // Skip classification of images/videos smaller than a given file size (in bytes; '0' = do not skip) | ||||||
| private int skipSize = 0; | ||||||
|
|
||||||
| // Skip classification of images/videos smaller than a given dimension, i.e. height or width (in pixels; '0' = do not skip) | ||||||
| private int skipDimension = 0; | ||||||
|
|
||||||
| // Skip classification of images/videos with hits on IPED hashesDB database (if 'hashesDB' is not configured in 'LocalConfig.txt' or 'false', do not skip) | ||||||
| private boolean skipHashDBFiles = true; | ||||||
|
|
||||||
| // Validate server SSL certificate | ||||||
| private boolean validateSSL = false; | ||||||
|
||||||
| private boolean validateSSL = false; | |
| private boolean validateSSL = true; |
Copilot
AI
Mar 3, 2026
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
The labelingThreshold property is defined and parsed in RemoteImageExternalClassifierConfig (with a getter getLabelingThreshold()), and also documented in RemoteImageExternalClassifierConfig.txt. However, the task RemoteImageExternalClassifierTask never reads or uses this value. Since this is described as "Optional: used only if backend also returns legacy 'class' probabilities", the field appears to be dead configuration. Either remove the unused property from the config and config file, or document clearly that it will be used in a future version.
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
The new task is enabled by default (
enableRemoteImageExternalClassifier = true), while the existing similar taskenableRemoteImageClassifieris disabled by default (false), and all other optional/external-service-dependent features inIPEDConfig.txt(PhotoDNA, OCR, face recognition, remote image classifier, etc.) are also disabled by default. Enabling this task by default means every user who does not have the external service running will encounter a connection error at startup (which only logs a warning and disables the task). This is inconsistent with the project's convention of shipping optional features disabled. It should be set tofalseby default.