python-kwargs-setattr-security

Problem Pattern

Using hasattr(obj, k) / setattr(obj, k, v) with user-controlled kwargs is insecure. The hasattr check is NOT a security guard — it returns True for ALL exposed properties including dangerous ones.

# INSECURE — do not use
for k, v in kwargs.items():
    if hasattr(options, k):
        setattr(options, k, v)

Fix: Explicit Allowlist

Define a module-level frozenset of safe attribute names. Raise RuntimeError for known-but-blocked attrs; silently ignore unknown keys.

# Define at module level, before the class
_ALLOWED_SESSION_OPTIONS = frozenset({
    "enable_cpu_mem_arena",
    "enable_mem_pattern",
    # ... only explicitly reviewed safe attrs
})

# In the method
for k, v in kwargs.items():
    if k in _ALLOWED_SESSION_OPTIONS:
        setattr(options, k, v)
    elif hasattr(options, k):  # reuse the existing instance, don't create new
        raise RuntimeError(
            f"SessionOptions attribute '{k}' is not permitted via the backend API. "
            f"Allowed attributes: {', '.join(sorted(_ALLOWED_SESSION_OPTIONS))}"
        )
    # else: silently ignore (may be kwargs for a different config object)

Key Rules

1. Use the existing object in hasattr(options, k) — never hasattr(ClassName(), k) (creates throwaway C++ objects per iteration)
2. RuntimeError is the ORT convention for API misuse errors (not ValueError)
3. Silent ignore for one path is OK when kwargs are forwarded to both paths: run_model() passes the same kwargs dict to both prepare() (validates SessionOptions) and rep.run() (validates RunOptions). A RunOptions kwarg unknown to SessionOptions is silently ignored by prepare() — this is correct because rep.run() will validate it. Only raise RuntimeError when the attr exists on the target object but is blocked.
4. Frozenset constant naming: _ALLOWED_<CLASSNAME> — ALL_CAPS, Google Style
5. No type annotations on module-level constants (ORT Python convention)

Dangerous SessionOptions Properties (never allowlist)

• optimized_model_filepath — triggers Model::Save(), overwrites arbitrary files
• profile_file_prefix + enable_profiling — writes profiling JSON to arbitrary path
• register_custom_ops_library — loads arbitrary shared libraries (method, not property)

Files in ONNX Runtime

• onnxruntime/python/backend/backend.py — _ALLOWED_SESSION_OPTIONS
• onnxruntime/python/backend/backend_rep.py — _ALLOWED_RUN_OPTIONS
• Tests: onnxruntime/test/python/onnxruntime_test_python_backend.py — TestBackendKwargsAllowlist