transformers
7e0ff853 - Fix potential ReDoS by escaping tokenizer filename used as regex pattern (#47498)

Commit
31 days ago
Fix potential ReDoS by escaping tokenizer filename used as regex pattern (#47498) * Fix potential ReDoS by escaping tokenizer filename used as regex pattern vocab_files["tokenizer_file"] originates from the model repository's tokenizer_config.json but was passed to re.search() as the regex pattern, so a repository-controlled filename could inject regex metacharacters and trigger catastrophic backtracking during from_pretrained. Wrap it in re.escape() to match the literal filename; behaviour is unchanged for normal filenames. * Fix replaced re with a plain not in check
Author
Parents
Loading