Skip to content

fix: use safe deserialization and tarfile extraction #70

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
gn00295120 wants to merge 2 commits into
base: main
Choose a base branch
from
Open

fix: use safe deserialization and tarfile extraction #70

Show file tree
Hide file tree
Changes from 1 commit
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
820aa38
fix: use safe deserialization and tarfile extraction
gn00295120 Mar 22, 2026
ea8e97c
fix: add Python < 3.12 fallback for safe tarfile extraction
gn00295120 Mar 22, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
2 changes: 1 addition & 1 deletion moshi/moshi/models/lm.py
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -976,7 +976,7 @@ def load_voice_prompt(self, voice_prompt: str):

def load_voice_prompt_embeddings(self, path: str):
self.voice_prompt = path
state = torch.load(path)
state = torch.load(path, weights_only=True)

self.voice_prompt_audio = None
self.voice_prompt_embeddings = state["embeddings"].to(self.lm_model.device)
Expand Down
6 changes: 3 additions & 3 deletions moshi/moshi/models/loaders.py
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -157,7 +157,7 @@ def get_mimi(filename: str | Path,
if _is_safetensors(filename):
load_model(model, filename)
else:
pkg = torch.load(filename, "cpu")
pkg = torch.load(filename, "cpu", weights_only=True)
model.load_state_dict(pkg["model"])
model.set_num_codebooks(8)
return model
Expand Down Expand Up @@ -214,7 +214,7 @@ def get_moshi_lm(
else:
# torch checkpoint
with open(filename, "rb") as f:
state_dict = torch.load(f, map_location="cpu")
state_dict = torch.load(f, map_location="cpu", weights_only=True)
# Patch 1: expand depformer self_attn weights if needed
model_sd = model.state_dict()
for name, tensor in list(state_dict.items()):
Expand Down Expand Up @@ -292,7 +292,7 @@ def _get_moshi_lm_with_offload(
state_dict = load_file(filename, device="cpu")
else:
with open(filename, "rb") as f:
state_dict = torch.load(f, map_location="cpu")
state_dict = torch.load(f, map_location="cpu", weights_only=True)

# Apply weight patches (same as non-offload path)
model_sd = model.state_dict()
Expand Down
2 changes: 1 addition & 1 deletion moshi/moshi/offline.py
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -142,7 +142,7 @@ def _get_voice_prompt_dir(voice_prompt_dir: Optional[str], hf_repo: str) -> Opti
if not voices_dir.exists():
log("info", f"extracting {voices_tgz} to {voices_dir}")
with tarfile.open(voices_tgz, "r:gz") as tar:
tar.extractall(path=voices_tgz.parent)
tar.extractall(path=voices_tgz.parent, filter='data')
Copy link

Copilot AI Mar 22, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

tarfile.extractall(..., filter='data') is not supported on Python 3.10/3.11 and will raise TypeError at runtime. Since the project currently supports Python >=3.10, please add a compatibility fallback (manual safe extraction) or bump the minimum supported Python version.

Copilot uses AI. Check for mistakes.

if not voices_dir.exists():
raise RuntimeError("voices.tgz did not contain a 'voices/' directory")
Expand Down
4 changes: 2 additions & 2 deletions moshi/moshi/server.py
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -330,7 +330,7 @@ def _get_voice_prompt_dir(voice_prompt_dir: Optional[str], hf_repo: str) -> Opti
if not voices_dir.exists():
logger.info(f"extracting {voices_tgz} to {voices_dir}")
with tarfile.open(voices_tgz, "r:gz") as tar:
tar.extractall(path=voices_tgz.parent)
tar.extractall(path=voices_tgz.parent, filter='data')
Copy link

Copilot AI Mar 22, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

tarfile.TarFile.extractall() only supports the filter kwarg on Python 3.12+; this repo declares requires-python = ">= 3.10", so on 3.10/3.11 this will raise TypeError: extractall() got an unexpected keyword argument 'filter' at runtime. Consider either (a) raising the minimum supported Python to 3.12 (and documenting it), or (b) feature-detecting support for filter (e.g., via inspect.signature) and falling back to a manual “safe extract” implementation that rejects absolute paths, .. traversal, and symlinks/hardlinks.

Copilot uses AI. Check for mistakes.

if not voices_dir.exists():
raise RuntimeError("voices.tgz did not contain a 'voices/' directory")
Expand All @@ -346,7 +346,7 @@ def _get_static_path(static: Optional[str]) -> Optional[str]:
dist = dist_tgz.parent / "dist"
if not dist.exists():
with tarfile.open(dist_tgz, "r:gz") as tar:
tar.extractall(path=dist_tgz.parent)
tar.extractall(path=dist_tgz.parent, filter='data')
Copy link

Copilot AI Mar 22, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Same compatibility issue as above: passing filter='data' to extractall() will crash on Python < 3.12, but moshi/pyproject.toml currently allows Python 3.10+. Please add a version/feature-detected fallback safe extraction path (or bump the minimum Python version accordingly).

Copilot uses AI. Check for mistakes.
return str(dist)
elif static != "none":
# When set to the "none" string, we don't serve any static content.
Expand Down
Loading