Fix path traversal in TensorRT EP RefitEngine

[Chi Lo (chilo-ms)]

Summary

Fix a path traversal vulnerability in the TensorRT and NvTensorRTRTX Execution Providers' RefitEngine() function. Path validation was deliberately disabled at production call sites, allowing malicious ONNX models to potentially read arbitrary files when weight-stripped engine refitting is active.

Problem

RefitEngine() accepted a path_check parameter that controlled whether path traversal validation was performed. All non-EPContext call sites passed false, completely bypassing security checks. Additionally, the NvTensorRTRTX onnx_ctx_model_helper.cc had inverted logic (ep_context_model_path_.empty() instead of !...empty()), which disabled path checks when loading from files -- the exact case where validation is most needed.

An attacker could craft a malicious ONNX model with a traversal path in the ONNX_MODEL_FILENAME attribute (e.g. ../../../etc/passwd) to cause the runtime to read arbitrary filesystem paths during engine refitting.

Fix

• Remove the path_check parameter from RefitEngine() in both TensorRT EP and NvTensorRTRTX EP -- path validation via ValidateExternalDataPathFromDir() is now unconditional
• At internal call sites, extract just the filename from model_path_ and derive the folder path so validation can verify directory containment (model_path_ is a full absolute path from graph.ModelPath(), which would be rejected by the validator as-is)
• Remove make_secure_path_checks variable from both onnx_ctx_model_helper.cc files (no longer needed since validation is always on)

Files Changed

• onnxruntime/core/providers/tensorrt/tensorrt_execution_provider.h -- remove path_check parameter
• onnxruntime/core/providers/tensorrt/tensorrt_execution_provider.cc -- always validate, fix call sites
• onnxruntime/core/providers/tensorrt/onnx_ctx_model_helper.cc -- remove now-unused variable and argument
• onnxruntime/core/providers/nv_tensorrt_rtx/nv_execution_provider.h -- remove path_check parameter
• onnxruntime/core/providers/nv_tensorrt_rtx/nv_execution_provider.cc -- always validate, fix call site
• onnxruntime/core/providers/nv_tensorrt_rtx/onnx_ctx_model_helper.cc -- remove inverted-logic variable and argument

[Copilot]

Pull request overview

This PR hardens TensorRT EP and NvTensorRTRTX EP weight-stripped engine refitting by making external-data path validation unconditional in RefitEngine(), removing call-site flags that could bypass traversal protections.

Changes:

• Removed the path_check parameter from RefitEngine() in both TensorRT EP and NvTensorRTRTX EP, making validation always-on.
• Updated internal non-EPContext call sites to pass the model filename + derived folder path (instead of a full absolute model path) so the directory-containment validator can succeed.
• Removed now-unused make_secure_path_checks variables and their arguments from both onnx_ctx_model_helper.cc implementations.

Reviewed changes

Copilot reviewed 6 out of 6 changed files in this pull request and generated 1 comment.

Show a summary per file

File	Description
onnxruntime/core/providers/tensorrt/tensorrt_execution_provider.h	Removes path_check from RefitEngine() declaration so validation can’t be disabled.
onnxruntime/core/providers/tensorrt/tensorrt_execution_provider.cc	Makes model-path validation unconditional and updates internal call sites to pass folder+filename.
onnxruntime/core/providers/tensorrt/onnx_ctx_model_helper.cc	Removes unused conditional path-check flag and argument passing.
onnxruntime/core/providers/nv_tensorrt_rtx/nv_execution_provider.h	Removes path_check from RefitEngine() declaration for NvTensorRTRTX EP.
onnxruntime/core/providers/nv_tensorrt_rtx/nv_execution_provider.cc	Makes model-path validation unconditional and updates internal call site to pass folder+filename.
onnxruntime/core/providers/nv_tensorrt_rtx/onnx_ctx_model_helper.cc	Removes unused conditional path-check flag/argument (including the previously inverted logic path).

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.