Skip to content

fix: Add model name validation for model management requests#472

Merged
pskiran1 merged 5 commits intomainfrom
spolisetty/tri-736-psirt-path-traversal-triton-inference-server-grpc-interface
Mar 3, 2026
Merged

fix: Add model name validation for model management requests#472
pskiran1 merged 5 commits intomainfrom
spolisetty/tri-736-psirt-path-traversal-triton-inference-server-grpc-interface

Conversation

@pskiran1
Copy link
Member

@pskiran1 pskiran1 commented Feb 23, 2026

This pull request adds input validation for model names in model management requests to prevent path traversal attacks. The validation ensures that model names used in the load operation cannot contain directory traversal sequences or path separators that could be exploited to access files outside the intended model repository.

CI: triton-inference-server/server#8672

@pskiran1 pskiran1 requested a review from Copilot February 23, 2026 05:41
@pskiran1 pskiran1 added the PR: fix A bug fix label Feb 23, 2026
@pskiran1 pskiran1 changed the title fix: Add model name validation for model management requests" fix: Add model name validation for model management requests Feb 23, 2026
Copy link

Copilot AI left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Pull request overview

This pull request adds input validation for model names in model management requests to prevent path traversal attacks. The validation ensures that model names used in load/unload operations cannot contain directory traversal sequences or path separators that could be exploited to access files outside the intended model repository.

Changes:

  • Added ValidateModelName function to check for empty names and path traversal characters (.., /, )
  • Integrated validation into LoadUnloadModel to protect the model loading/unloading entry point
  • Updated copyright year to 2026

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

whoisj
whoisj previously approved these changes Feb 27, 2026
Copy link
Contributor

@yinggeh yinggeh left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Well done

@pskiran1 pskiran1 merged commit 66f09f8 into main Mar 3, 2026
1 check passed
@pskiran1 pskiran1 deleted the spolisetty/tri-736-psirt-path-traversal-triton-inference-server-grpc-interface branch March 3, 2026 05:14
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

PR: fix A bug fix

Development

Successfully merging this pull request may close these issues.

5 participants