trace_585887808ff443cca3b5773edb4286f8

Start with `onnx/checker.cc` and the Python external-data load path in `onnx/external_data_helper.py`. This source file has a known vulnerability sink in it. Traverse the codebase and report the vulnerability. You can report multiple vulnerabilities. Keep the analysis grounded in how a model-controlled external data location is validated and then opened/read by `onnx.load`.

{
  "executiveSummary": "The ONNX external-data loading path has an incomplete path-validation vulnerability in `resolve_external_data_location` (onnx/checker.cc). While the function checks that external data paths are not symlinks, it does not reject hardlinked files in the vulnerable version of the code. A hardlinked file passes both `is_symlink()` (which returns false for hardlinks) and `is_regular_file()` (which returns true for hardlinks), making the validation treat a hardlink to an arbitrary system file as a legitimate external data source. After validation, `load_external_data_for_tensor` in `onnx/external_data_helper.py` opens the validated path and reads its contents, allowing a malicious ONNX model to exfiltrate arbitrary file contents via hardlinks placed within the model directory. The fix adds a `hard_link_count > 1` check (lines 1032-1040 of checker.cc), but the vulnerable version lacks this, enabling the attack.",
  "reports": [
    {
      "title": "Hardlink bypass in resolve_external_data_location allows arbitrary file read via ONNX external data",
      "severity": "HIGH",
      "summary": "The C++ function `resolve_external_data_location` in `onnx/checker.cc` validates external data file paths by rejecting symlinks (`is_symlink()`) and requiring `is_regular_file()`, but does not reject hardlinked files. Since a hardlink is neither a symlink nor a non-regular file, it passes both checks. A malicious ONNX model can reference an external data file that is a hardlink to an arbitrary system file (e.g., `/etc/shadow`). After validation, Python's `load_external_data_for_tensor` opens and reads the file, leaking its contents into the model's tensor data.",
      "rootCauseAnalysis": "The `resolve_external_data_location` function validates that the external data path is not a symlink (line 1016: `is_symlink()`) and is a regular file (line 1024: `is_regular_file()`), but it does not check the hard link count. On POSIX systems, a hardlink is a directory entry pointing to the same inode as another file. `is_symlink()` returns false for hardlinks, and `is_regular_file()` returns true for them. Thus, a hardlink placed within the model directory passes all validation checks and is subsequently opened and read by the Python loader.",
      "impact": "A malicious ONNX model can read arbitrary files on the system where it is loaded. By creating a hardlink inside the model directory to a sensitive file (e.g., SSH private keys, credentials, configuration files), an attacker can cause the ONNX loader to read the target file's contents and embed them in the model's tensor data, which can then be extracted by the attacker.",
      "attackPath": "1. Attacker crafts a malicious ONNX model file with a tensor marked as EXTERNAL data location\n2. The external data 'location' field points to a file within the model directory (e.g., 'sensitive.bin')\n3. Attacker pre-creates a hardlink at that path pointing to a target file (e.g., `ln /etc/shadow ./model_di