fix pyyaml according to: https://github.com/Anchor0221/CVE-2025-50460 (#1428)

modelscope/exporters/cv/object_detection_damoyolo_exporter.py

@@ -30,16 +30,28 @@ class ObjectDetectionDamoyoloExporter(TorchModelExporter):
         self.model.onnx_export = True
         self.model.eval()
         _ = self.model(dummy_input)
-        torch.onnx._export(
+        try:
-            self.model,
+            torch.onnx._export(
-            dummy_input,
+                self.model,
-            onnx_file,
+                dummy_input,
-            input_names=[
+                onnx_file,
-                'images',
+                input_names=[
-            ],
+                    'images',
-            output_names=[
+                ],
-                'pred',
+                output_names=[
-            ],
+                    'pred',
-            opset_version=opset)
+                ],
+                opset_version=opset)
+        except AttributeError:
+            torch.onnx.export(
+                self.model, (dummy_input, ),
+                onnx_file,
+                input_names=[
+                    'images',
+                ],
+                output_names=[
+                    'pred',
+                ],
+                opset_version=opset)
 
         return {'model', onnx_file}

modelscope/fileio/format/yaml.py

@@ -14,7 +14,7 @@ class YamlHandler(FormatHandler):
 
     def load(self, file, **kwargs):
         kwargs.setdefault('Loader', Loader)
-        return yaml.load(file, **kwargs)
+        return yaml.safe_load(file)
 
     def dump(self, obj, file, **kwargs):
         kwargs.setdefault('Dumper', Dumper)

modelscope/models/base/base_model.py

@@ -197,6 +197,9 @@ class Model(ABC):
                 'Use trust_remote_code=True. Will invoke codes or install plugins from remote model repo. '
                 'Please make sure that you can trust the external codes.')
         register_modelhub_repo(local_model_dir, allow_remote=trust_remote_code)
+        default_args = {}
+        if trust_remote_code:
+            default_args = {'trust_remote_code': trust_remote_code}
         register_plugins_repo(plugins)
         for k, v in kwargs.items():
             model_cfg[k] = v
@@ -206,7 +209,8 @@ class Model(ABC):
             model_cfg.init_backbone = True
             model = build_backbone(model_cfg)
         else:
-            model = build_model(model_cfg, task_name=task_name)
+            model = build_model(
+                model_cfg, task_name=task_name, default_args=default_args)
 
         # dynamically add pipeline info to model for pipeline inference
         if hasattr(cfg, 'pipeline'):

requirements/framework.txt

@@ -4,6 +4,7 @@ datasets>=3.0.0,<=3.6.0
 einops
 Pillow
 python-dateutil>=2.1
+PyYAML>=5.4
 scipy
 setuptools
 simplejson>=3.3.0

tests/fileio/test_io.py

@@ -10,15 +10,7 @@ from modelscope.fileio.io import dump, dumps, load
 class FileIOTest(unittest.TestCase):
 
     def test_format(self, format='json'):
-        obj = [
+        obj = [1, 2, 3, 'str', {'model': 'resnet'}, [1, 2]]
-            1, 2, 3, 'str', {
-                'model': 'resnet'
-            },
-            np.array([[1, 2]], dtype=np.float16),
-            np.array([[1, 2]], dtype=np.float32),
-            np.array([[1, 2]], dtype=np.float64),
-            np.array([[1, 2]], dtype=np.int64), (1, 2)
-        ]
         result_str = dumps(obj, format)
         temp_name = tempfile.gettempdir() + '/' + next(
             tempfile._get_candidate_names()) + '.' + format

tests/utils/test_hf_util.py

@@ -2,6 +2,7 @@
 import os
 import shutil
 import tempfile
+import time
 import unittest
 import uuid
 
@@ -235,12 +236,14 @@ class HFUtilTest(unittest.TestCase):
             logger.info('patch create repo result: ' + commit_info.commit_url)
             self.assertTrue(commit_info is not None)
             from huggingface_hub import file_exists
+            time.sleep(1)
             self.assertTrue(file_exists(self.create_model_name, '1.json'))
             from huggingface_hub import upload_file
             commit_info: CommitInfo = upload_file(
                 path_or_fileobj=self.test_file2,
                 path_in_repo='test_folder2',
                 repo_id=self.create_model_name)
+            time.sleep(1)
             self.assertTrue(
                 file_exists(self.create_model_name, 'test_folder2/2.json'))