Fix validation for external data paths for models loaded from bytes

[adrianlizarraga]

Description

This PR fixes the validation of external data paths when ONNX models are loaded from bytes (in-memory). Previously, when a model was loaded from bytes without an explicit external data folder path being set, path using ".." sequences were not properly validated, potentially allowing access to arbitrary files on the filesystem.

Motivation and Context

Address a security concern

[Copilot]

Pull request overview

This PR fixes a security vulnerability in the validation of external data paths when ONNX models are loaded from bytes (in-memory). Previously, when a model was loaded from bytes without an explicit external data folder path being set, path traversal attacks using ".." sequences were not properly validated, potentially allowing access to arbitrary files on the filesystem.

Changes:

• Added path traversal validation for in-memory models with empty base directory
• Added comprehensive test coverage for the security fix
• Extended unit tests to cover the new validation path

Reviewed changes

Copilot reviewed 3 out of 3 changed files in this pull request and generated 3 comments.

File	Description
onnxruntime/core/framework/tensorprotoutils.cc	Adds validation logic to reject paths containing ".." when base_dir is empty (model loaded from bytes)
onnxruntime/test/framework/tensorutils_test.cc	Adds unit test case for path traversal validation with empty base directory
onnxruntime/test/shared_lib/test_inference.cc	Adds two integration tests for in-memory model loading with malicious external data paths

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[tianleiwu]

Here is AI analysis:

Low: Empty-base-dir validation rejects safe filenames that contain .. (valid in Linux/MacOS)

• File: onnxruntime/core/framework/tensorprotoutils.cc:383
• Issue: The new check uses substring matching:
  • norm_location.native().find("..") != npos
  • This rejects paths like weights..bin (or foo..bar/data.bin) even though they do not include a .. path component and do not traverse directories.
• Impact: Behavior regression for valid external data locations when models are loaded from bytes with no external-data folder override.
• Recommendation: Check path components for exact .. segments instead of substring search. For example, iterate norm_location components and fail only when a component is exactly ...

Test Coverage Gaps

• The new tests cover traversal patterns (../data.bin, a/../../data.bin) and normalization (a/../data.bin) but do not cover non-traversal filenames containing .. text.
• Suggested addition in onnxruntime/test/framework/tensorutils_test.cc:
  • ASSERT_STATUS_OK(utils::ValidateExternalDataPath("", "weights..bin"));

Overall

• The security intent is good and the main traversal case is addressed.
• The current implementation is overly broad in one spot and can be tightened without weakening security.

[yuslepukhin]

I am not sure this does not re-introduce the issue of symlinks escaping the directory. Plus, we always want the paths to be relative within the external data reference.