Repository navigation
security: prevent Tar-Slip in uncompress() and unsafe pickle in load_language_model() - #1971
Open
zewolkt3939 wants to merge 1 commit into
Open
zewolkt3939 wants to merge 1 commit into
zewolkt3939 wants to merge 1 commit into
Conversation
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
This PR hardens two archive/model loading paths that are reachable from the
public resource-loading API (get_resource / hanlp.load), which downloads and
opens remote (including third-party) resources.
hanlp/utils/io_util.py — uncompress()
extractall() was called on downloaded TAR archives without validating member
paths, allowing a crafted archive (members like "../../x" or absolute paths)
to write files outside the destination directory (Tar-Slip / CWE-22). Added a
_safe_extractall() helper that rejects members (and symlink/hardlink targets)
resolving outside dest, then extracts. The zipfile branch already relies on
CPython's sanitisation but is validated too for consistency.
hanlp/layers/embeddings/contextual_string_embedding.py — load_language_model()
torch.load(model_file) was called without weights_only=True, so a crafted .pt
could execute code during unpickling (CWE-502). Now uses weights_only=True
with a TypeError fallback for very old PyTorch, matching the pattern already
used in common/torch_component.py and utils/torch_util.py.
No public API changes; both fixes are transparent for legitimate archives/models.
