From f0ba9fa2e1ad8efc4924a00485e73fc641ad6035 Mon Sep 17 00:00:00 2001 From: Daniel Han Date: Mon, 29 Jun 2026 10:38:17 +0000 Subject: [PATCH] Studio diffusion (Phase 9) review round 2: correct prequant allowlist doc Codex review: the transformer_prequant_path field description still told operators to enable local checkpoints with UNSLOTH_ALLOW_LOCAL_PREQUANT_PATH=1, but the prior security fix made that variable a directory allowlist -- _allowed_prequant_roots deliberately drops bare on/off toggle tokens (1/true/yes/...). An operator following the documented =1 would have every transformer_prequant_path request silently refused. The description now states it must name one or more allowlisted directories and that a bare on/off value is not accepted. Test: asserts the field help references UNSLOTH_ALLOW_LOCAL_PREQUANT_PATH, does not say =1, and describes an allowlist/directory (guards against doc drift). --- studio/backend/models/inference.py | 5 ++++- studio/backend/tests/test_diffusion_routes.py | 13 +++++++++++++ 2 files changed, 17 insertions(+), 1 deletion(-) diff --git a/studio/backend/models/inference.py b/studio/backend/models/inference.py index 237b9e90f7..998b8814b4 100644 --- a/studio/backend/models/inference.py +++ b/studio/backend/models/inference.py @@ -1746,7 +1746,10 @@ class DiffusionLoadRequest(BaseModel): "GPU (~half the load VRAM and a smaller download). null uses the family's hosted " "checkpoint if configured, else quantises the dense transformer at load time. " "Loading a local path unpickles the file (arbitrary code execution), so it is " - "ignored unless the operator sets UNSLOTH_ALLOW_LOCAL_PREQUANT_PATH=1.", + "ignored unless the path resolves inside a directory the operator allowlisted " + "via UNSLOTH_ALLOW_LOCAL_PREQUANT_PATH (one or more directories, separated by " + "the OS path separator). A bare on/off value such as '1' is deliberately not " + "accepted -- it must name an allowed directory.", ) diff --git a/studio/backend/tests/test_diffusion_routes.py b/studio/backend/tests/test_diffusion_routes.py index cd41397901..48db3429af 100644 --- a/studio/backend/tests/test_diffusion_routes.py +++ b/studio/backend/tests/test_diffusion_routes.py @@ -359,6 +359,19 @@ def test_transformer_prequant_path_threads_through(client, monkeypatch): assert backend.last_load_kwargs.get("transformer_prequant_path") == "/data/zimage_fp8.pt" +def test_prequant_path_doc_describes_allowlist_not_toggle(): + # The field help must match the code: UNSLOTH_ALLOW_LOCAL_PREQUANT_PATH is a + # directory allowlist, not a =1 toggle (diffusion_prequant._allowed_prequant_roots + # drops bare on/off tokens), so operators following the doc don't get every + # request silently refused. + from models.inference import DiffusionLoadRequest + + desc = DiffusionLoadRequest.model_fields["transformer_prequant_path"].description + assert "UNSLOTH_ALLOW_LOCAL_PREQUANT_PATH" in desc + assert "=1" not in desc + assert "allowlist" in desc.lower() or "director" in desc.lower() + + def test_invalid_transformer_quant_returns_422_without_eviction(client): # An unsupported transformer_quant is rejected by the request schema (Literal), so # the GPU is never acquired and no chat model is evicted.