Avner/ssd correctness

[avnermay]

No description provided.

[broly-code-security-scanner]

Broly Security Scan

Note

Baseline snapshot is missing for this repo. Broly is running in PR-only fallback mode until the first scheduled baseline completes. This does not block the PR.

Note

Summary

1 actionable finding(s) in this PR
2 total in scan · 1 dismissed false positive

• 🟠 1 high

All actionable items are in the table below.

Severity	Scanner	Issue	Location	Dismiss	Verdict
🟠 HIGH	SAST	Unsafe deserialization of untrusted .pt files via torch.load(..., weights_only=False).	tests/hf/trace_reader.py:120	d1	🔺 TRUE_POSITIVE · Confidence: HIGH

---

Fix Suggestions

Unsafe deserialization of untrusted .pt files via `torch.load(..., weights_only=False)`. — tests/hf/trace_reader.py:120

Set weights_only=True in the torch.load call to restrict deserialization to tensor data only, preventing arbitrary code execution from untrusted .pt files.

• Changes torch.load(f, weights_only=False) to torch.load(f, weights_only=True) on line 120 of load_prefills.
• weights_only=True restricts deserialization to tensor and primitive types, blocking arbitrary pickle code execution from malicious .pt files.
• Limitation: load_trace and any other call sites in trace_reader.py that use torch.load(..., weights_only=False) remain vulnerable and must be fixed separately.

--- a/tests/hf/trace_reader.py
+++ b/tests/hf/trace_reader.py
@@ -117,7 +117,12 @@
     """Each prefill dump split into per-seq records: prompt token list + eagle acts slice."""
     out = []
     for f in sorted(Path(trace_dir).glob("prefill_request_*.pt")):
-        d = torch.load(f, weights_only=False)
+          d = torch.load(f, weights_only=True)
+FIX_RANGE: 120
+FIX_NOTES:
+- Changes `torch.load(f, weights_only=False)` to `torch.load(f, weights_only=True)` on line 120 of `load_prefills`.
+- `weights_only=True` restricts deserialization to tensor and primitive types, blocking arbitrary pickle code execution from malicious `.pt` files.
+- Limitation: `load_trace` and any other call sites in `trace_reader.py` that use `torch.load(..., weights_only=False)` remain vulnerable and must be fixed separately.
         num_tokens = d["num_tokens"].tolist()
         ids = d["input_ids"].tolist()
         acts = d.get("eagle_acts")

---

🟢 Dismissed false positives (1) — not shown above

• 🟠 HIGH · Weak hash (MD5) · tests/hf/trace_reader.py:35 — hash_ridis a test utility that replicates the productionhash_to_int64` function for mapping dump rows to requests by request ID, not a security control — no secrets, passwords, or authentication material are hashed.

Dismiss false positives

Tick a box to dismiss the finding; untick it to bring the finding back. That is the same as replying /broly dismiss d1 and /broly undismiss d1. To record why it is a false positive, reply with /broly dismiss d1: your reason instead — Broly reuses those reasons to triage similar findings across the org.

• d1 · 🟠 HIGH     · tests/hf/trace_reader.py:120 · Unsafe deserialization of untrusted .pt files via `torch.load(..., weights_on...

Note

Re-scan this PR anytime with /broly scan — useful after /broly undismiss, or to refresh findings without a new push.

Broly — SAST (zai-org/GLM-5.2) · Secrets · SCA · IaC · GH Actions · Base Images · Supply Chain Threats · Exploit Chains · Adversarial Verification

We're continuously improving Broly's accuracy and finding quality — your feedback is valuable. False positives, missed findings, bugs, and feature requests all welcome.