fix: bound the image fetch in the TRT-LLM preprocessing template

src/triton_cli/templates/trt_llm/preprocessing/1/model.py

@@ -1,4 +1,4 @@
-# Copyright 2024, NVIDIA CORPORATION & AFFILIATES. All rights reserved.
+# Copyright 2024-2026, NVIDIA CORPORATION & AFFILIATES. All rights reserved.
 #
 # Redistribution and use in source and binary forms, with or without
 # modification, are permitted provided that the following conditions
@@ -28,6 +28,7 @@
 import io
 import json
 import os
+import time
 from typing import List
 
 import numpy as np
@@ -702,6 +703,12 @@ class VisionPreProcessor:
     in preparation for the vision encoder.
     """
 
+    # Bounds on fetching an image from a request-supplied URL. Adjust these
+    # together with the outbound network policy enforced around the server.
+    IMAGE_FETCH_TIMEOUT_SECONDS = 5  # no data received for this long
+    IMAGE_FETCH_MAX_SECONDS = 30  # entire transfer
+    IMAGE_FETCH_MAX_BYTES = 32 * 1024 * 1024
+
     def __init__(self,
                  vision_model_type,
                  vision_model_processor,
@@ -765,8 +772,25 @@ def load_images_from_urls(self, img_urls):
                 image_buffer = io.BytesIO(image_data)
                 images.append(Image.open(image_buffer))
             else:
-                images.append(
-                    Image.open(requests.get(img_url, stream=True).raw))
+                response = requests.get(
+                    img_url,
+                    stream=True,
+                    timeout=self.IMAGE_FETCH_TIMEOUT_SECONDS)
+                response.raise_for_status()
+                deadline = time.monotonic() + self.IMAGE_FETCH_MAX_SECONDS
+                image_data = bytearray()
+                for chunk in response.iter_content(chunk_size=65536):
+                    image_data.extend(chunk)
+                    if len(image_data) > self.IMAGE_FETCH_MAX_BYTES:
+                        raise ValueError(
+                            f"[TensorRT-LLM][ERROR] Image at {img_url} exceeds "
+                            f"the {self.IMAGE_FETCH_MAX_BYTES} byte limit.")
+                    if time.monotonic() > deadline:
+                        raise ValueError(
+                            f"[TensorRT-LLM][ERROR] Image at {img_url} took "
+                            f"longer than {self.IMAGE_FETCH_MAX_SECONDS} "
+                            "seconds to download.")
+                images.append(Image.open(io.BytesIO(image_data)))
         return images
 
     def mllama_process(self, queries, img_urls=None, image_bytes=None):