docs(security): annotate CWE-502 pickle/torch.load sites (Refs helicalAI/dashboard#1154) - #384
Closed
oriolpetithelical wants to merge 1 commit into
Closed
docs(security): annotate CWE-502 pickle/torch.load sites (Refs helicalAI/dashboard#1154)#384oriolpetithelical wants to merge 1 commit into
oriolpetithelical wants to merge 1 commit into
Conversation
…ch and read/write counterpart
Add a 3-line comment block above each of the 16 CWE-502 pickle / torch.load
findings in helical/models. Annotation only -- no executable code changed
(all added lines are comments; files still compile).
Each block records:
1. the finding URL,
2. which Airflow DAG(s) in the dags repo reach the call (DAG -> container
script -> helical function), or "none" with how it is actually run,
3. the read<->write pickle counterpart (in-repo path:line, external S3/HF
artifact, or "no in-repo reader").
Traces were cross-checked by independent sub-agents against helical@release
and dags@develop.
Refs #1154
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01PjQewSrSBRm13a9M2hm5hE
oriolpetithelical
added a commit
that referenced
this pull request
Jul 10, 2026
…rep) (#385) * fix(security): harden CWE-502 torch.load sites with weights_only + nosemgrep Follow-up to the annotation-only PR #384. Mitigates the CWE-502 (unsafe deserialization) scan findings from helicalAI/dashboard#1154 for the torch.load sites, and suppresses the Trail of Bits scanner on the sites that are now safe or unavoidably require full unpickling. Groups A + B (torch.load) addressed here; group C (raw pickle.load of gene dictionaries) is intentionally deferred to a follow-up. - weights_only=True (real mitigation) added to the loads whose payloads are tensors / plain state dicts: scgpt best_model.pt, uce all_tokens.torch, uce gene-embedding dicts, and the uce model-weights load (the last was missed by the Bastion scan but hardened for consistency). Under the pinned torch 2.7.0 this matches the existing default, so it is a no-op at runtime and only hardens intent. - HyenaDNA keeps weights_only=False: its Lightning-style .ckpt carries non-tensor objects the safe loader rejects. Documented + suppressed with a "trusted sources" justification (a try-safe-first attempt was rejected in review: it fired a misleading CWE-502 warning and double-read the file on every legitimate load). - base_models legacy fallback keeps weights_only=False (pre-v2.0.0 full-model pickles); documented + suppressed, reached only when the safe load fails. - Every torch.load carries a `# nosemgrep: trailofbits.python.pickles-in-pytorch.pickles-in-pytorch` on the line immediately preceding the call (Semgrep only honors adjacent suppressions) plus a per-site CWE-502 justification. Validated: scGPT and HyenaDNA load real downloaded checkpoints end-to-end; py_compile passes on all touched files. CI exercises these load paths against real (non-mocked) upstream artifacts. Refs helicalAI/dashboard#1154
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What & why
Annotation-only PR for the CWE-502 (unsafe deserialization) scan findings tracked in helicalAI/dashboard#1154. No executable code is changed — every added line is a comment; all touched files still compile.
A 3-line block is added directly above each of the 16 flagged
pickle.load/pd.read_pickle/torch.load/pickle.dumpsites inhelical/models/, recording:nonewith a note on how it is actually run.path:line, an external S3/HF artifact, or "no in-repo reader").Triage summary (from the trace)
helicalpackageS3 bucket viafinetuning/embedding/attention_analysis/perturbation/evaluationDAGs (+ nebius finetuning variants).base_modelssites (UCE/Tahoe run only via examples/notebooks;base_models.load_modelis bypassed by bio-agent's own loader).base_models.py:296(save_model→torch.save) — cleanest safe-load fix candidate.geneformer_utils.py:38writes a pickle nothing reads.Verification
git diffconfirms only comment lines added, nothing removed.python -m py_compilepasses on all 11 files.dag_ids, container scripts, S3 keys, read/write counterparts) was independently re-verified by adversarial sub-agents againsthelical@releaseanddags@develop.Refs helicalAI/dashboard#1154
🤖 Generated with Claude Code