Conversation
…#20868) Co-authored-by: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
Signed-off-by: Vladislav Nosivskoy <vladnosiv@gmail.com> Co-authored-by: ishandhanani <82981111+ishandhanani@users.noreply.github.com>
…ect#20793) Co-authored-by: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
…d on diffusion models (sgl-project#20687)
Co-authored-by: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
…g - matching TP (sgl-project#19920) Co-authored-by: Claude Opus 4.6 <noreply@anthropic.com> Co-authored-by: Ishan Dhanani <ishan@dhanani.dev>
Co-authored-by: Ethan (Yusheng) Su <yushengsu.thu@gmail.com>
![arnica-github-connector[bot]](https://avatars.githubusercontent.com/in/144692?s=60&v=4){kind=small}
| extra_max_context_len = 4 | ||
| if self.server_args.speculative_num_draft_tokens is not None: | ||
| extra_max_context_len += self.server_args.speculative_num_draft_tokens | ||
| if SpeculativeAlgorithm.from_string(self.server_args.speculative_algorithm).is_async(): |
There was a problem hiding this comment.
Static Code Analysis Risk: Together python jinja2 ssti
User-controlled input is used as a Jinja2 template string (Server-Side Template Injection). Jinja2 templates can execute arbitrary Python code via class/mro traversal (CWE-94). Load templates from trusted static sources only; pass user data as render() variables, never as the template itself.
Severity: High 🚨
Status: Open 🔴
References:
- https://cwe.mitre.org/data/definitions/94
- https://portswigger.net/web-security/server-side-template-injection
- https://jinja.palletsprojects.com/en/3.1.x/api/#jinja2.Template
Suggested reviewers 🧐: @avnermay
More details:
If you see an issue, please contact Shasheen in the #security-engineering Slack channel.
Take action by replying with an [arnica] command 💬
Actions
Use [arnica] or [a] to interact with the Arnica bot to acknowledge or dismiss code risks.
To acknowledge the finding as a valid code risk: [arnica] ack <acknowledge additional details>
To dismiss the risk with a reason: [arnica] dismiss <fp|accept|capacity> <dismissal reason>
Examples
-
[arnica] ack This is a valid risk and I'm looking into it -
[arnica] dismiss fp Dismissed - Risk Not Accurate: (i.e. False Positive) -
[arnica] dismiss accept Dismiss - Risk Accepted: Allow the risk to exist in the system -
[arnica] dismiss capacity Dismiss - No Capacity: This will need to wait for a future sprint
Syntax soiree! 👏 - 1 code risk was fixed in this branch🎉 Kudos to: @avnermay SAST (Static Application Security Testing)
Loved it? 😍 Follow us or share your experience on LinkedIn or X. |
20 participants
Motivation
Modifications
Accuracy Tests
Benchmarking and Profiling
Checklist
Review Process
/tag-run-ci-label,/rerun-failed-ci,/tag-and-rerun-ci