fix: harden GGUF/ZIP polyglot detection#1775
Conversation
|
@codex review |
Performance BenchmarksCompared
|
There was a problem hiding this comment.
Pull request overview
This PR hardens GGUF scanning by computing a “declared content boundary” and flagging/inspecting unexplained trailing bytes, including detecting GGUF/ZIP polyglots and delegating ZIP member inspection to the existing archive dispatch pipeline (so hidden pickles/path traversal/nested content are covered consistently).
Changes:
- Compute a GGUF logical end offset (including the final tensor payload) and validate/flag trailing content with bounded zero-padding tolerance.
- Detect GGUF/ZIP polyglots (S908) and reuse
merge_executable_zip_container_findingsto scan embedded archive members. - Propagate a trusted “container-owned trailing boundary” marker for GGUF payloads carved from Llamafile containers, and add targeted regression coverage.
Reviewed changes
Copilot reviewed 4 out of 4 changed files in this pull request and generated 1 comment.
| File | Description |
|---|---|
| tests/scanners/test_gguf_scanner.py | Adds regression tests for GGUF trailing bytes, bounded padding, ZIP polyglots, archive traversal, and scanner-selection/CLI behavior. |
| modelaudit/scanners/llamafile_scanner.py | Marks carved GGUF payloads as container-owned for trailing-boundary validation and preserves ZIP polyglot merging behavior. |
| modelaudit/scanners/gguf_scanner.py | Implements trailing-content validation and GGUF/ZIP polyglot detection + archive dispatch integration. |
| CHANGELOG.md | Documents the GGUF/ZIP polyglot and trailing-content validation hardening under Unreleased bug fixes. |
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 9bb572c90e
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: f170d70fe4
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: d1d286e4a5
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: d54ef005f8
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: c4ebcb2976
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 105b78415d
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: a621269c70
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: a72134e5a7
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
…uf-polyglot-hardening-20260721
There was a problem hiding this comment.
Pull request overview
Copilot reviewed 6 out of 6 changed files in this pull request and generated no new comments.
Comments suppressed due to low confidence (1)
modelaudit/scanners/gguf_scanner.py:769
_scan_zip_polyglot()callszipfile.is_zipfile()and then immediately callsmerge_executable_zip_container_findings(), which performs its ownis_zipfileprobe. This results in redundant file opens/reads on every GGUF scan.
You can drop the direct is_zipfile call and instead gate S908 emission on whether merge_executable_zip_container_findings() actually dispatched for this path (it records the path in private metadata), while still honoring the existing preflight-rejected path marker.
if not zipfile.is_zipfile(self.current_file_path):
return False
from .archive_dispatch import (
_ZIP_CONTAINER_PREFLIGHT_REJECTED_PATHS_PRIVATE_METADATA_KEY,
Summary
S908rule and reuse the existing ZIP/archive dispatch to inspect hidden pickle, path-traversal, and nested content.Why
GGUF parsers can legitimately stop after the declared tensor payload while ZIP readers recognize a valid archive from the same file's end. This change improves format identification and defense in depth by recognizing both interpretations and delegating archive inspection to the scanner infrastructure that already enforces extraction and recursion limits.
Validation
PROMPTFOO_DISABLE_TELEMETRY=1 pytest tests/scanners/test_gguf_scanner.py tests/scanners/test_llamafile_scanner.py tests/scanners/test_zip_scanner.py tests/test_gguf_sbom_integration.py -n 4 -m "not slow and not integration" --maxfail=2 -q— 1,664 passed.ruff format --check modelaudit/ packages/modelaudit-picklescan/src packages/modelaudit-picklescan/tests tests/— passed.ruff check modelaudit/ packages/modelaudit-picklescan/src packages/modelaudit-picklescan/tests tests/— passed.mypy modelaudit/scanners/gguf_scanner.py modelaudit/scanners/llamafile_scanner.py tests/scanners/test_gguf_scanner.py— passed.The complete local suite cannot collect in the existing environment because the optional compiled
modelaudit_picklescan._rustextension is absent; CI builds the native extension.Thanks
Thank you to @mgm-77 for the thoughtful report and clear proof of concept that inspired this defense-in-depth improvement.