Enhance path validation in check_tarfile_security for windows#20924
Merged
TomeHirata merged 2 commits intomlflow:masterfrom Feb 19, 2026
Merged
Enhance path validation in check_tarfile_security for windows#20924TomeHirata merged 2 commits intomlflow:masterfrom
TomeHirata merged 2 commits intomlflow:masterfrom
Conversation
…eventing Windows path traversal vulnerabilities. Added tests for escaped path handling to ensure compliance with security standards. Signed-off-by: Tomu Hirata <tomu.hirata@gmail.com>
Contributor
There was a problem hiding this comment.
Pull request overview
Improves tar archive path validation to prevent Windows-style backslash path traversal from bypassing check_tarfile_security, and adds a regression test to cover the bypass case.
Changes:
- Normalize tar member names by converting
\to/beforeposixpath.normpathduring validation. - Add a unit test that creates a tar entry with
..\\..\\...traversal and asserts it is rejected.
Reviewed changes
Copilot reviewed 2 out of 2 changed files in this pull request and generated 2 comments.
| File | Description |
|---|---|
mlflow/utils/file_utils.py |
Normalizes backslashes before validating tar member paths to prevent Windows separator bypass. |
tests/utils/test_file_utils.py |
Adds a regression test for backslash-based traversal in tar member names. |
Comments suppressed due to low confidence (1)
mlflow/utils/file_utils.py:1037
check_tarfile_securitynow normalizes backslashes, but the absolute-path check only rejects POSIX-style absolute paths (path.startswith('/')). On Windows, tar entries likeC:\tmp\pwned.txt(->C:/tmp/pwned.txt) are still treated as relative and could escape the extraction dir. Consider rejecting Windows absolute paths too (e.g., viapathlib.PureWindowsPath(path).is_absolute()/ntpath.isabs()on the normalized path) and add a unit test for a drive-letter absolute member name.
# Normalize backslashes to forward slashes before path validation to prevent
# bypass on Windows where backslashes are treated as directory separators.
path = posixpath.normpath(m.name.replace("\\", "/"))
if m.issym():
symlink_set.add(path)
else:
if path.startswith("/"):
raise MlflowException(
Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com> Signed-off-by: TomuHirata <tomu.hirata@gmail.com>
Contributor
|
Documentation preview for ba6533a is available at: More info
|
daniellok-db
pushed a commit
to daniellok-db/mlflow
that referenced
this pull request
Feb 20, 2026
…#20924) Signed-off-by: Tomu Hirata <tomu.hirata@gmail.com> Signed-off-by: TomuHirata <tomu.hirata@gmail.com> Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>
daniellok-db
pushed a commit
that referenced
this pull request
Feb 20, 2026
Signed-off-by: Tomu Hirata <tomu.hirata@gmail.com> Signed-off-by: TomuHirata <tomu.hirata@gmail.com> Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Related Issues/PRs
https://huntr.com/bounties/5d83cc95-1d97-4780-ad16-62756eb0914f
What changes are proposed in this pull request?
See this ticket for details
How is this PR tested?
Does this PR require documentation update?
Does this PR require updating the MLflow Skills repository?
Release Notes
Is this a user-facing change?
What component(s), interfaces, languages, and integrations does this PR affect?
Components
area/tracking: Tracking Service, tracking client APIs, autologgingarea/models: MLmodel format, model serialization/deserialization, flavorsarea/model-registry: Model Registry service, APIs, and the fluent client calls for Model Registryarea/scoring: MLflow Model server, model deployment tools, Spark UDFsarea/evaluation: MLflow model evaluation features, evaluation metrics, and evaluation workflowsarea/gateway: MLflow AI Gateway client APIs, server, and third-party integrationsarea/prompts: MLflow prompt engineering features, prompt templates, and prompt managementarea/tracing: MLflow Tracing features, tracing APIs, and LLM tracing functionalityarea/projects: MLproject format, project running backendsarea/uiux: Front-end, user experience, plotting, JavaScript, JavaScript dev serverarea/build: Build and test infrastructure for MLflowarea/docs: MLflow documentation pagesHow should the PR be classified in the release notes? Choose one:
rn/none- No description will be included. The PR will be mentioned only by the PR number in the "Small Bugfixes and Documentation Updates" sectionrn/breaking-change- The PR will be mentioned in the "Breaking Changes" sectionrn/feature- A new user-facing feature worth mentioning in the release notesrn/bug-fix- A user-facing bug fix worth mentioning in the release notesrn/documentation- A user-facing documentation change worth mentioning in the release notesShould this PR be included in the next patch release?
Yesshould be selected for bug fixes, documentation updates, and other small changes.Noshould be selected for new features and larger changes. If you're unsure about the release classification of this PR, leave this unchecked to let the maintainers decide.What is a minor/patch release?
Bug fixes, doc updates and new features usually go into minor releases.
Bug fixes and doc updates usually go into patch releases.