Skip to content

fix(workflow-operator): accept single-segment HF model IDs and reject '..' in the model-id check #7474

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
xuang7 merged 1 commit into from
Aug 10, 2026
+10 −4
Merged

fix(workflow-operator): accept single-segment HF model IDs and reject '..' in the model-id check #7474

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
10 changes: 6 additions & 4 deletions ...n/scala/org/apache/texera/amber/operator/huggingFace/codegen/HuggingFaceCodegenBase.scala
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -72,9 +72,11 @@ object HuggingFaceCodegenBase {
|
|# Defensive format check for MODEL_ID before it is interpolated into
|# HF URL paths. The base host is hardcoded so the worst case isn't
|# SSRF, but rejecting `..` segments / query strings / fragments /
|# control chars keeps the operator's request shape predictable.
|_HF_MODEL_ID_PATTERN = re.compile(r"^[A-Za-z0-9][A-Za-z0-9._-]*(/[A-Za-z0-9._-]+)+$$")
|# SSRF, but rejecting `..` traversal / query strings / fragments /
|# control chars keeps the operator's request shape predictable. The
|# leading (?!.*\.\.) rejects any `..`; the trailing /segment group is
|# optional so single-segment legacy IDs like `gpt2` are also accepted.
|_HF_MODEL_ID_PATTERN = re.compile(r"^(?!.*\.\.)[A-Za-z0-9][A-Za-z0-9._-]*(/[A-Za-z0-9._-]+)*$$")
|
|class ProcessTableOperator(UDFTableOperator):
|
Expand Down Expand Up @@ -488,7 +490,7 @@ object HuggingFaceCodegenBase {
| if not _HF_MODEL_ID_PATTERN.match(self.MODEL_ID or ""):
| raise ValueError(
| f"Invalid Hugging Face model ID '{self.MODEL_ID}'. "
| f"Expected format like 'org/model-name' or 'org/model-name/revision'."
| f"Expected a model ID like 'gpt2', 'org/model-name', or 'org/model-name/revision'."
| )
|
| # --- resolve API token ---
Expand Down
4 changes: 4 additions & 0 deletions ...t/scala/org/apache/texera/amber/operator/huggingFace/HuggingFaceInferenceOpDescSpec.scala
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -141,6 +141,10 @@ class HuggingFaceInferenceOpDescSpec extends AnyFlatSpec with Matchers {
code should include("if not _HF_MODEL_ID_PATTERN.match(")
code should include("raise ValueError(")
code should include("Invalid Hugging Face model ID")
// #7196: reject `..` path traversal (leading negative lookahead) and accept
// single-segment legacy IDs like `gpt2` (trailing /segment group optional).
code should include("(?!.*\\.\\.)")
code should include("(/[A-Za-z0-9._-]+)*$")
}

it should "not leak raw user-input strings into the generated Python source" in {
Expand Down
Loading