Adapter-sync LoRA weight sync (supersedes #90) + reload correctness fixes - #94
Adapter-sync LoRA weight sync (supersedes #90) + reload correctness fixes#94qywu wants to merge 6 commits into
Broly: 1 finding(s), none at or above high
Note
Summary
1 actionable finding(s) in this PR
- 🟡 1 medium
All actionable items are in the annotations.
No finding is at or above high, so this check is not blocking. The findings above are still tracked and reported.
Scanned in 2m6.598s.
Annotations
Check warning on line 517 in src/xorl/server/weight_sync/handler.py
broly-code-security-scanner / Broly Security Scan
[MEDIUM] Path traversal via unsanitized `model_id` in adapter export directory construction. The `model_id` field from the request payload is used directly in `os.path.join` without sanitization, unlike `weight_version` which is sanitized through `_safe_abort_token`. An attacker can supply a `model_id` containing `../` sequences or an absolute path to write LoRA adapter files to arbitrary filesystem locations.
Path traversal via unsanitized `model_id` in adapter export directory construction. The `model_id` field from the request payload is used directly in `os.path.join` without sanitization, unlike `weight_version` which is sanitized through `_safe_abort_token`. An attacker can supply a `model_id` containing `../` sequences or an absolute path to write LoRA adapter files to arbitrary filesystem locations.: An authenticated user who can send weight sync requests with a crafted `model_id` (e.g., `../../../tmp/evil` or `/tmp/evil`) can cause `self.trainer.save_lora_only()` to write adapter files (including `adapter_model.safetensors` and `adapter_config.json`) to arbitrary directories outside the intended `base_dir/weight_sync_adapters/` path. Because `os.path.join` discards all prior components when a subsequent component is an absolute path, supplying `model_id="/tmp/evil"` makes `export_dir` resolve to `/tmp/evil/latest`, completely bypassing the base directory. This enables arbitrary file write to any location writable by the training process, potentially overwriting critical files or injecting malicious adapter configurations. The attack requires authenticated access to the training server's weight sync API.