Sync LoRA sessions as adapters; drop merged-weight LoRA sync - #90
Closed
qywu wants to merge 2 commits into
Closed
Broly - Code Security Scanner / Broly Security Scan
succeeded
Aug 27, 2026 in 0s
Broly: 1 finding(s), none at or above high
Note
Summary
1 actionable finding(s) in this PR
- 🟡 1 medium
All actionable items are in the annotations.
No finding is at or above high, so this check is not blocking. The findings above are still tracked and reported.
Scanned in 3m41.472s.
Annotations
Check warning on line 517 in src/xorl/server/weight_sync/handler.py
broly-code-security-scanner / Broly Security Scan
[MEDIUM] Path traversal via unsanitized `model_id` in adapter export directory construction. The `model_id` parameter from the command payload is used directly in `os.path.join` without any path sanitization, allowing an attacker to write adapter files (safetensors + config JSON) to arbitrary filesystem locations.
Path traversal via unsanitized `model_id` in adapter export directory construction. The `model_id` parameter from the command payload is used directly in `os.path.join` without any path sanitization, allowing an attacker to write adapter files (safetensors + config JSON) to arbitrary filesystem locations.: The `handle_sync_inference_weights` entry point receives `command_dict` from an external caller. The `model_id` field (`p.model_id`) flows unsanitized into `_export_adapter_for_sync`, where it becomes `resolved_model_id` and is used in `os.path.join(base_dir, "weight_sync_adapters", resolved_model_id, version_token)`. If `model_id` contains path traversal sequences (e.g., `"../../../../tmp/evil"`), the resulting `export_dir` escapes the intended `base_dir`. The subsequent `self.trainer.save_lora_only(export_dir, ...)` writes files to this traversed path. Note that `weight_version` is sanitized via `_safe_abort_token` (which strips `/` and other dangerous characters), but `model_id` receives no such treatment. Exploitation requires authenticated access to the training RPC interface and a LoRA training session with an `adapter_manager`.
Loading