[CORE] Add path security check for model serialization #31820

barnasm1 · 2025-08-20T14:54:26Z

Details:

add path safety checking
unify error messages
remove double quote at error messages

Tickets:

171532

…move double quote

…r_model_serialization

praasz · 2025-08-21T07:10:16Z

src/core/src/pass/serialize.cpp

    }
 }

+const std::filesystem::path check_path_safety(const std::filesystem::path& path) {


Re-use update current utils functions:
Use ov::util::sanitize_path which should remove traversal part from path.

There are also utils like in std like canonical, weakly_canonical

praasz · 2025-08-21T07:14:57Z

src/core/src/pass/serialize.cpp

+
+    return check_path_safety(path);


Suggested change

return check_path_safety(path);

OPENVINO_ASSERT(!std::filesystem::is_symlink(path), "Path must not be symbolic link: " , path);

return ov::util::sanitize(path);

praasz · 2025-08-21T07:17:50Z

src/core/src/pass/serialize.cpp

        auto path = xml_path;
        path.replace_extension(".bin");
-        return path;
+        return check_path_safety(path);


The xml path should be validated and bin path can be created without check

praasz · 2025-08-21T07:22:03Z

src/core/src/pass/serialize.cpp

+        return check_path_safety(path);
    } else {
-        return bin_path;
+        return check_path_safety(bin_path);


Check if not symlink and use sanitize path to remove traversal part.

Update doxy for class to mention that traversal part from path will be removed and symlinks are not allowed

…nk issues

t-jankowski · 2025-08-21T12:46:11Z

src/core/tests/file_util.cpp

+        string path = "a/b/../../../../tensor.data";
+        EXPECT_STREQ("a/b/tensor.data", ov::util::prevent_path_traversal(path).string().c_str());


Why .. is skipped over (ignored)? Shouldn't it end up as ../../tensor.data?

To prevent traversal into parent directories

Proposed solution changes the path in fact. Is it what user expects (is aware of)?
Example path from another test a/b/../tensor.data doesn't leave working directory and should end up as a/tensor.data.
Generally I don't think OV should bother where a user wants its files to be stored in.

@jszczepa Could you please share the motivation for preventing path traversal

…ath instead of std::string

…ation

praasz · 2025-08-25T11:15:48Z

src/common/util/src/file_util.cpp

+                    path);

-    return safe_path;
+    OPENVINO_ASSERT(std::filesystem::is_symlink(path) == false, "Path must not refer to a symbolic link: ", path);


Suggested change

OPENVINO_ASSERT(std::filesystem::is_symlink(path) == false, "Path must not refer to a symbolic link: ", path);

OPENVINO_ASSERT(!std::filesystem::is_symlink(path), "Path must not refer to a symbolic link: ", path);

praasz · 2025-08-25T12:09:03Z

src/common/util/src/file_util.cpp

    return (start == std::string::npos) ? "" : sanitized_path.substr(start);
 }

+const std::filesystem::path ov::util::check_path_safety(const std::filesystem::path& path) {


Make this function simple like:

bool is_path_traversal(const std::filesystem::path& path){ return std::find(path.begin(), path.end(), "..") != path.end(); }

praasz · 2025-08-25T12:10:12Z

src/common/util/src/file_util.cpp

 #include <fstream>
 #include <sstream>

+#include "openvino/core/except.hpp"


Is not part of util library

praasz · 2025-08-25T12:11:10Z

src/common/util/include/openvino/util/file_util.hpp

 /// \return A sanitized path
 std::string sanitize_path(const std::string& path);

+/// \brief Check the safety of a file path by expecting no parent directory references ("..") and no symbolic links


Should current dir . be checked, also?

praasz · 2025-08-25T12:11:40Z

src/core/include/openvino/pass/serialize.hpp

 * @brief Serialize transformation converts ov::Model into IR files
 * @attention
 * - dynamic shapes are not supported
+ * - any parent directory traversal (e.g. ".." in path) will be removed from output file paths


It should be updated

praasz · 2025-08-25T12:12:15Z

src/common/util/include/openvino/util/file_util.hpp

+/// references.
+/// \param path A path to file
+/// \return A validated path to file
+const std::filesystem::path check_path_safety(const std::filesystem::path& path);


Add test for this function ?
Add some Unicode examples?
Why return path form function which check only?

praasz · 2025-09-05T06:38:02Z

src/core/src/pass/serialize.cpp

-                    path,
-                    "\"");
-    return path;
+                    "Path for xml file doesn't contains file name with 'xml' extension: ",


Consider change this helper to:

void validate_ir_path(const std::filesystem::path& path, std::filesystem::path&& ext){ OPENVINO_ASSERT(path.extension() == ext, "Path ", path, " doesn't contains file name with ", ext, " extension"); OPENVINO_ASSERT(!is_path_traversal(path), "Path has traversal component: ", path); OPENVINO_ASSERT(!std::filesystem::is_symlink(path), "Path is symlink ", path); }

And use for xml, bin file validation, and additional check can be added here if required.

barnasm1 added 3 commits August 20, 2025 14:32

Add path safety checks for XML and BIN file paths in serialization

34bb674

Refactor error messages in path validation for XML and BIN files - re…

25cd94d

…move double quote

Merge branch 'openvinotoolkit:master' into add_path_security_check_fo…

de02de2

…r_model_serialization

barnasm1 self-assigned this Aug 20, 2025

barnasm1 requested a review from a team as a code owner August 20, 2025 14:54

barnasm1 requested review from mryzhov and removed request for a team August 20, 2025 14:54

github-actions bot added the category: Core OpenVINO Core (aka ngraph) label Aug 20, 2025

Add path security validation tests for serialization

66208c4

barnasm1 requested a review from a team as a code owner August 20, 2025 16:23

mlukasze added this to the 2025.3 milestone Aug 21, 2025

mlukasze added the Code Freeze label Aug 21, 2025

praasz reviewed Aug 21, 2025

View reviewed changes

barnasm1 added 5 commits August 21, 2025 08:38

Update documentation for Serialize class

da5954b

Refactor path safety checks in serialization

0a5dd54

Add path security validation tests

1eb7e26

Add prevent_path_traversal function

f506dd3

Add path safety checks to prevent directory traversal and symbolic li…

6724b9a

…nk issues

barnasm1 requested a review from a team as a code owner August 21, 2025 11:16

github-actions bot added category: transformations OpenVINO Runtime library - Transformations category: CPP API OpenVINO CPP API bindings labels Aug 21, 2025

t-jankowski reviewed Aug 21, 2025

View reviewed changes

barnasm1 added 3 commits August 21, 2025 14:43

Refactor prevent_path_traversal function to accept std::filesystem::p…

d7d23c5

…ath instead of std::string

Merge branch 'master' into add_path_security_check_for_model_serializ…

a9b7d76

…ation

Refactor path safety checks: remove tests

ef73d0c

praasz reviewed Aug 25, 2025

View reviewed changes

praasz removed the Code Freeze label Sep 1, 2025

praasz reviewed Sep 5, 2025

View reviewed changes

-    return check_path_safety(path);
+       OPENVINO_ASSERT(!std::filesystem::is_symlink(path), "Path must not be symbolic link: " , path);
+    return ov::util::sanitize(path);

		string path = "a/b/../../../../tensor.data";
		EXPECT_STREQ("a/b/tensor.data", ov::util::prevent_path_traversal(path).string().c_str());

	OPENVINO_ASSERT(std::filesystem::is_symlink(path) == false, "Path must not refer to a symbolic link: ", path);
	OPENVINO_ASSERT(!std::filesystem::is_symlink(path), "Path must not refer to a symbolic link: ", path);

[CORE] Add path security check for model serialization #31820

Are you sure you want to change the base?

[CORE] Add path security check for model serialization #31820

Conversation

barnasm1 commented Aug 20, 2025

Details:

Tickets:

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

praasz Aug 25, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

4 participants

praasz Aug 25, 2025 •

edited

Loading