Repository navigation

fix(sglang): validate diffusion input_reference and bound media fetches - #14435

Merged

dmitry-tokarev-nv merged 19 commits into

mainfrom

neelays/harden-diffusion-input-reference

Sep 16, 2026

Commits on Sep 8, 2026
- fix(sglang): validate diffusion input_reference against traversal and SSRF
  
  nnshah1
  and
  claude
  committed
  ec5be86
- fix(sglang): extend input_reference validation to video diffusion; share helper
  
  nnshah1
  and
  claude
  committed
  4db60f8
- fix(common-http): percent-decode file:// media paths (review)
  
  nnshah1
  and
  claude
  committed
  92201a2
Commits on Sep 10, 2026
- fix(sglang): fetch diffusion input_reference URLs SSRF-safe (review)
  
  nnshah1
  and
  claude
  committed
  5070d4c
Commits on Sep 11, 2026
- Merge remote-tracking branch 'origin/main' into pr14435-fix
  dmitry-tokarev-nv
  committed
  f7e48c0
- fix(common-http): bound the media reference echoed into errors and logs
  
  dmitry-tokarev-nv
  and
  claude
  committed
  0debb20
- fix(common-http): let a caller cap how many bytes fetch_bytes will buffer
  
  dmitry-tokarev-nv
  and
  claude
  committed
  b716ec5
- fix(common-http): make local_media_reference yield only a local path
  
  dmitry-tokarev-nv
  and
  claude
  committed
  df50430
- fix(sglang): return 400 for a rejected diffusion input_reference
  
  dmitry-tokarev-nv
  and
  claude
  committed
  1d215cd
- fix(common-http): bound the URL echoed by validate_url and the redirect cap
  
  dmitry-tokarev-nv
  and
  claude
  committed
  82aeb11
- fix(common-http): close four gaps from a second review pass
  
  dmitry-tokarev-nv
  and
  claude
  committed
  02346fe
- fix(common-http): bound HttpStatusError where the binding actually reads it
  
  dmitry-tokarev-nv
  and
  claude
  committed
  dbf9e1d
- Merge remote-tracking branch 'origin/main' into pr14435-fix
  dmitry-tokarev-nv
  committed
  4abc822
- fix(common-http): stop the HttpStatusError bound eating actionable guidance
  
  dmitry-tokarev-nv
  and
  claude
  committed
  6ffa332
Commits on Sep 14, 2026
- Merge remote-tracking branch 'origin/main' into pr14435-fix
  dmitry-tokarev-nv
  committed
  ec106be
Commits on Sep 15, 2026
- Merge branch 'main' into pr14435-fix
  
  dmitry-tokarev-nv
  and
  claude
  committed
  1fad15c
- fix(common-http): bound the OSError diagnostic and the data-URI media type
  
  dmitry-tokarev-nv
  and
  claude
  committed
  3f7e3db
Commits on Sep 16, 2026
- fix(common-http): name aiohttp, not the removed backend, in two comments
  
  dmitry-tokarev-nv
  and
  claude
  committed
  3230408
- feat(common-http): make the media download cap operator-tunable
  
  dmitry-tokarev-nv
  and
  claude
  committed
  75c1a6d

Navigation Menu

Repository navigation

fix(sglang): validate diffusion input_reference and bound media fetches - #14435

fix(sglang): validate diffusion input_reference and bound media fetches#14435
dmitry-tokarev-nv merged 19 commits into
mainfrom
neelays/harden-diffusion-input-reference

Commits on Sep 8, 2026

fix(sglang): validate diffusion input_reference against traversal and SSRF

fix(sglang): extend input_reference validation to video diffusion; share helper

fix(common-http): percent-decode file:// media paths (review)

Commits on Sep 10, 2026

fix(sglang): fetch diffusion input_reference URLs SSRF-safe (review)

Commits on Sep 11, 2026

Merge remote-tracking branch 'origin/main' into pr14435-fix

fix(common-http): bound the media reference echoed into errors and logs

fix(common-http): let a caller cap how many bytes fetch_bytes will buffer

fix(common-http): make local_media_reference yield only a local path

fix(sglang): return 400 for a rejected diffusion input_reference

fix(common-http): bound the URL echoed by validate_url and the redirect cap

fix(common-http): close four gaps from a second review pass

fix(common-http): bound HttpStatusError where the binding actually reads it

Merge remote-tracking branch 'origin/main' into pr14435-fix

fix(common-http): stop the HttpStatusError bound eating actionable guidance

Commits on Sep 14, 2026

Merge remote-tracking branch 'origin/main' into pr14435-fix

Commits on Sep 15, 2026

Merge branch 'main' into pr14435-fix

fix(common-http): bound the OSError diagnostic and the data-URI media type

Commits on Sep 16, 2026

fix(common-http): name aiohttp, not the removed backend, in two comments

feat(common-http): make the media download cap operator-tunable