UPSTREAM PR #1156: fix: sanitize LoRA paths and enable dynamic loading#43
UPSTREAM PR #1156: fix: sanitize LoRA paths and enable dynamic loading#43
Conversation
- Implement `sanitize_lora_path` in `SDGenerationParams` to prevent directory traversal attacks via LoRA tags in prompts. - Restrict LoRA paths to be relative and strictly within the configured LoRA directory (no subdirectories allowed, optional? drawback: users cannot organize their LoRAs into subfolders.). - Update server example to pass `lora_model_dir` to `process_and_check`, enabling LoRA extraction from prompts. - Force `LORA_APPLY_AT_RUNTIME` in the server to allow applying LoRAs dynamically per request without reloading the model.
- Remove the restriction that LoRA models must be in the root of the LoRA directory, allowing them to be organized in subfolders. - Refactor the directory containment check to use `std::mismatch` instead of `lexically_relative` to verify the path is inside the allowed root. - Remove redundant `lexically_normal()` call when resolving file extensions.
loci-dev
force-pushed
the
main
branch
22 times, most recently
from
f99a420 to
a234621
Compare
loci-dev
temporarily deployed
to
stable-diffusion-cpp-prod
GitHub Actions
Inactive
OverviewAnalysis of 48,102 functions (100 modified, 10 new, 4 removed) across two binaries reveals minimal performance impact from security enhancements. Power consumption: build.bin.sd-server decreased 0.06% (512,975.76 nJ → 512,668.64 nJ), build.bin.sd-cli increased 0.1% (479,167.23 nJ → 479,645.75 nJ). Function Analysisextract_and_remove_lora (both binaries): Response time increased 21.8% (+49.5μs) due to new Standard library regressions (compiler/toolchain differences, no source changes): Standard library improvements: Other analyzed functions showed negligible changes in non-critical paths. Additional FindingsCore ML inference pipeline (diffusion sampling, attention mechanisms, VAE operations) remains unaffected. The 5 commits focused on "sanitize LoRA paths and enable dynamic loading" successfully implement security hardening with <0.01% impact on end-to-end image generation time (5-30 seconds). Compiler optimizations offset security overhead, resulting in near-zero net power consumption change. 🔎 Full breakdown: Loci Inspector. |
loci-dev
force-pushed
the
main
branch
6 times, most recently
from
3ad80c4 to
74d69ae
Compare
loci-dev
temporarily deployed
to
stable-diffusion-cpp-prod
GitHub Actions
Inactive
OverviewAnalysis of 48,312 functions across two stable diffusion inference binaries reveals minimal overall performance impact despite 99 modified functions. Power consumption shows negligible changes: build.bin.sd-server decreased 0.062% (518,798.18 nJ → 518,475.41 nJ) and build.bin.sd-cli decreased 0.029% (483,665.30 nJ → 483,523.85 nJ). Ten new functions were added and four removed, with 48,199 functions unchanged. Function AnalysisAll significant performance changes occur in C++ standard library functions rather than application code, indicating compiler optimization differences between builds: Regressions:
Improvements:
No application source code changes were detected for any analyzed functions. Performance variations stem from GCC 13 standard library implementation differences or compiler optimization flag changes. The balanced improvements and regressions result in negligible net impact, confirmed by sub-0.1% power consumption changes. Additional FindingsAll analyzed functions affect initialization, memory management, and utility operations rather than compute-intensive inference paths. String comparison regressions impact model loading (tensor name lookups during GGUF parsing), but cumulative overhead remains under 2ms for typical models. Core ML operations (GGML tensor kernels, attention mechanisms, VAE processing) execute in backend-specific implementations not included in this analysis, explaining why standard library changes have minimal impact on overall performance. 🔎 Full breakdown: Loci Inspector. |
2 participants
Note
Source pull request: leejet/stable-diffusion.cpp#1156
sanitize_lora_pathinSDGenerationParamsto prevent directory traversal attacks via LoRA tags in prompts.lora_model_dirtoprocess_and_check, enabling LoRA extraction from prompts.LORA_APPLY_AT_RUNTIMEin the server to allow applying LoRAs dynamically per request without reloading the model and avoiding weight accumulation.