Unify path validation in EPs, address security gaps

Merged
YU
5mo ago
+345-103

This pull request strengthens security around external file paths used by various execution providers (TensorRT, NV TensorRT RTX, QNN, and OpenVINO) by replacing custom, ad-hoc path validation logic with a unified utility function, utils::ValidateExternalDataPath. This function ensures that external data paths do not escape the model directory, effectively preventing directory traversal, absolute path usage, and symlink-based escapes. The update also exposes this validation utility through the provider API for consistent use across providers.

Security improvements for external data path validation:

  • Replaced manual checks for absolute paths and .. parent directory traversal in TensorRT, NV TensorRT RTX, QNN, and OpenVINO providers with calls to utils::ValidateExternalDataPath, ensuring paths do not escape the model directory and improving protection against directory traversal and symlink attacks. [1] [2] [3] [4] [5] [6] [7] [8]

Provider API enhancements:

  • Added the ValidateExternalDataPath function to the provider API (provider_api.h, provider_interfaces.h) and implemented it in the provider bridge, making the unified validation utility accessible to all providers. [1] [2] [3]