github-starred/ollama
2
0
Fork 0
mirror of https://github.com/ollama/ollama.git synced 2026-05-22 13:42:25 -05:00
Code Issues 16.9k Packages Projects Releases 122 Wiki Activity

[PR #9379] [MERGED] server: validate local path on safetensor create #12935

New Issue
Closed
opened 2026-04-13 00:13:02 -05:00 by GiteaMirror · 0 comments
GiteaMirror commented 2026-04-13 00:13:02 -05:00
Owner
Copy Link

📋 Pull Request Information

Original PR: https://github.com/ollama/ollama/pull/9379
Author: @BruceMacD
Created: 2/26/2025
Status: ✅ Merged
Merged: 3/1/2025
Merged by: @BruceMacD

Base: main ← Head: brucemacd/create-path-valid

📝 Commits (10+)

  • b4c7fe6 server: validate local path on safetensor create
  • f7509ec Revert "server: validate local path on safetensor create"
  • 963353b server: validate local path on safetensor create
  • e727e3a move where error comes from
  • 287b11b Update create.go
  • 86914e7 use cleaned path in root.Stat
  • 8f737a8 use rel
  • 3284955 Update create.go
  • d90ae85 add positive cases to test
  • ab116af unneeded clean

📊 Changes

2 files changed (+131 additions, -1 deletions)

View changed files

📝 server/create.go (+25 -1)
➕ server/create_test.go (+106 -0)

📄 Description

This PR implements more validation during the safetensor creation process. The changes:

  • Properly handle relative paths (like ./model.safetensors) while rejecting absolute paths
  • Add comprehensive test coverage for various path scenarios including:
    • Valid relative paths with various notation styles
    • Nested directory references that remain within boundaries
    • Absolute paths
  • No functionality changes for valid inputs - existing workflows remain unaffected
  • Leverages Go 1.24's new os.Root functionality for secure containment

🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.

## 📋 Pull Request Information **Original PR:** https://github.com/ollama/ollama/pull/9379 **Author:** [@BruceMacD](https://github.com/BruceMacD) **Created:** 2/26/2025 **Status:** ✅ Merged **Merged:** 3/1/2025 **Merged by:** [@BruceMacD](https://github.com/BruceMacD) **Base:** `main` ← **Head:** `brucemacd/create-path-valid` --- ### 📝 Commits (10+) - [`b4c7fe6`](https://github.com/ollama/ollama/commit/b4c7fe60748bac8bd96557a4d8b613a367e605d3) server: validate local path on safetensor create - [`f7509ec`](https://github.com/ollama/ollama/commit/f7509ece756db7e7f1e87eb8e6103fe537f82887) Revert "server: validate local path on safetensor create" - [`963353b`](https://github.com/ollama/ollama/commit/963353b69075ae495b9b1e42e00fc7c1ed399a27) server: validate local path on safetensor create - [`e727e3a`](https://github.com/ollama/ollama/commit/e727e3a31db5a92fd15687db599d0184492dc563) move where error comes from - [`287b11b`](https://github.com/ollama/ollama/commit/287b11ba63b66ab3bf5fef78a6887e191484ebdf) Update create.go - [`86914e7`](https://github.com/ollama/ollama/commit/86914e7f86952644a045880a7cfff8541a7f2543) use cleaned path in root.Stat - [`8f737a8`](https://github.com/ollama/ollama/commit/8f737a873e94536966831303519f389974c2a45d) use rel - [`3284955`](https://github.com/ollama/ollama/commit/32849558ae311b07036c8264ce4cbe35af061bc8) Update create.go - [`d90ae85`](https://github.com/ollama/ollama/commit/d90ae8567b0fec9a05ff6df40f8c1b9cea5c0d8c) add positive cases to test - [`ab116af`](https://github.com/ollama/ollama/commit/ab116af8f0bde56edaf335165aadbb3ba035f521) unneeded clean ### 📊 Changes **2 files changed** (+131 additions, -1 deletions) <details> <summary>View changed files</summary> 📝 `server/create.go` (+25 -1) ➕ `server/create_test.go` (+106 -0) </details> ### 📄 Description This PR implements more validation during the safetensor creation process. The changes: - Properly handle relative paths (like `./model.safetensors`) while rejecting absolute paths - Add comprehensive test coverage for various path scenarios including: - Valid relative paths with various notation styles - Nested directory references that remain within boundaries - Absolute paths - No functionality changes for valid inputs - existing workflows remain unaffected - Leverages Go 1.24's new `os.Root` functionality for secure containment --- <sub>🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.</sub>
GiteaMirror added the pull-request label 2026-04-13 00:13:02 -05:00
Sign in to join this conversation.
No Branch/Tag Specified
Branches Tags
Labels
Clear labels
amd
api
app
bug
build
cli
cloud
compatibility
context-length
create
docker
documentation
embeddings
feature request
feedback wanted
good first issue
gpt-oss
gpu
harmony
help wanted
image
install
intel
js
launch
linux
macos
memory
mlx
model
needs more info
networking
nvidia
ollama.com
performance
pull-request
Mirrored from GitHub Pull Request
 python
question
registry
rendering
thinking
tools
top
vulkan
windows
wsl
No Label pull-request
Milestone
No items
No Milestone
Projects
Clear projects
No project
Assignees
Clear assignees
GiteaMirror ninjasurge
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: github-starred/ollama#12935
Delete Branch "%!s()"

Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?