Repository navigation
fix(config): stop model bundles from choosing runner and remote-code trust - #1576
Open
wanjiang263 wants to merge 1 commit into
Open
wanjiang263 wants to merge 1 commit into
wanjiang263 wants to merge 1 commit into
Conversation
…trust `load_model_config` merged every `config.json` sidecar and safetensors `__metadata__` field found inside the model directory straight into the startup config. A model bundle is untrusted input: a bundle could replace the caller-selected runner (`model_cls`) -- for example LTX-2.5 metadata forcing `cosmos3` -- or set `trust_remote_code`, re-enabling bundle-supplied code even when the loader honours the config flag. Route every model-bundle-derived merge through `update_from_model_bundle_config`, which drops the keys that decide which code LightX2V imports or which runner executes. Ordinary architecture fields still merge unchanged, so benign bundles are unaffected. Caller-supplied configs (`config_data` and `--config_json`) are deliberately left untouched: those are the caller's own input rather than the model's.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Related to #1559.
load_model_configmerged everyconfig.jsonsidecar and safetensors__metadata__field found inside the model directory straight into the startupconfig. A model bundle is untrusted input, so it could:
model_cls) — for example LTX-2.5 metadataforcing
cosmos3, redirecting the load into the cosmos3 runner;trust_remote_code, re-enabling bundle-supplied code even when the callerdisabled it.
This routes every model-bundle-derived merge through
update_from_model_bundle_config, which drops the keys that decide which codeLightX2V imports and which runner executes. Ordinary architecture fields still
merge unchanged, so benign bundles are unaffected.
Caller-supplied configs (
config_dataand--config_json) are deliberately leftuntouched — those are the caller's own input, not the model's.
Relationship to #1571
#1571 defaults the cosmos3 tokenizer's
trust_remote_codetoFalseviaself.config.get("trust_remote_code", False). That default is bypassable untilthis change lands: the cosmos3 branch merges
{model_path}/transformer/config.jsoninto the same config, so a bundle can set
trust_remote_code: truethere and bepicked up by that
.get().This PR does not touch cosmos3 and does not overlap with #1571 — it hardens the
config trust boundary that #1571 relies on.
Test plan
pre-commit run --all-files— all hooks passpytest tests/test_set_config_model_bundle_trust.py— 4 passed