llama-cpp-python 0.2.71__tar.gz → 0.2.72__tar.gz

llama_cpp_python-0.2.72/.git/FETCH_HEAD

@@ -0,0 +1 @@
+4badac3a60c6cef16d1249cae6b0c2af94cb9415		'4badac3a60c6cef16d1249cae6b0c2af94cb9415' of https://github.com/abetlen/llama-cpp-python

llama_cpp_python-0.2.72/.git/HEAD

@@ -0,0 +1 @@
+4badac3a60c6cef16d1249cae6b0c2af94cb9415

{llama_cpp_python-0.2.71 → llama_cpp_python-0.2.72}/.git/config

@@ -9,7 +9,7 @@
 [gc]
 	auto = 0
 [http "https://github.com/"]
-	extraheader = AUTHORIZATION: basic eC1hY2Nlc3MtdG9rZW46Z2hzX0NvN3dnY0E3NGZPc1JRODZ5WmtFTm1MR2U3R3M2bjFRVVByWg==
+	extraheader = AUTHORIZATION: basic eC1hY2Nlc3MtdG9rZW46Z2hzX2tYQWhwWTVaa1FyalpaNEpWck9VNkV0VVl0UDZGWTJFNmNsYg==
 [submodule "vendor/llama.cpp"]
 	active = true
 	url = https://github.com/ggerganov/llama.cpp.git

llama_cpp_python-0.2.72/.git/logs/HEAD

@@ -0,0 +1 @@
+0000000000000000000000000000000000000000 4badac3a60c6cef16d1249cae6b0c2af94cb9415 runner <runner@fv-az532-278.(none)> 1715317085 +0000	checkout: moving from master to refs/tags/v0.2.72

{llama_cpp_python-0.2.71 → llama_cpp_python-0.2.72}/.git/modules/vendor/llama.cpp/config

@@ -16,7 +16,7 @@
 [gc]
 	auto = 0
 [http "https://github.com/"]
-	extraheader = AUTHORIZATION: basic eC1hY2Nlc3MtdG9rZW46Z2hzX0NvN3dnY0E3NGZPc1JRODZ5WmtFTm1MR2U3R3M2bjFRVVByWg==
+	extraheader = AUTHORIZATION: basic eC1hY2Nlc3MtdG9rZW46Z2hzX2tYQWhwWTVaa1FyalpaNEpWck9VNkV0VVl0UDZGWTJFNmNsYg==
 [url "https://github.com/"]
 	insteadOf = git@github.com:
 	insteadOf = org-6826477@github.com:

llama_cpp_python-0.2.72/.git/modules/vendor/llama.cpp/logs/HEAD

@@ -0,0 +1,2 @@
+0000000000000000000000000000000000000000 8c570c9496212073079476651c7517c02581101f runner <runner@fv-az532-278.(none)> 1715317086 +0000	clone: from https://github.com/ggerganov/llama.cpp.git
+8c570c9496212073079476651c7517c02581101f 911b3900dded9a1cfe0f0e41b82c7a29baf3a217 runner <runner@fv-az532-278.(none)> 1715317087 +0000	checkout: moving from master to 911b3900dded9a1cfe0f0e41b82c7a29baf3a217

llama_cpp_python-0.2.72/.git/modules/vendor/llama.cpp/logs/refs/heads/master

@@ -0,0 +1 @@
+0000000000000000000000000000000000000000 8c570c9496212073079476651c7517c02581101f runner <runner@fv-az532-278.(none)> 1715317086 +0000	clone: from https://github.com/ggerganov/llama.cpp.git

llama_cpp_python-0.2.72/.git/modules/vendor/llama.cpp/logs/refs/remotes/origin/HEAD

@@ -0,0 +1 @@
+0000000000000000000000000000000000000000 8c570c9496212073079476651c7517c02581101f runner <runner@fv-az532-278.(none)> 1715317086 +0000	clone: from https://github.com/ggerganov/llama.cpp.git

{llama_cpp_python-0.2.71 → llama_cpp_python-0.2.72}/.git/modules/vendor/llama.cpp/modules/kompute/config

@@ -13,7 +13,7 @@
 [gc]
 	auto = 0
 [http "https://github.com/"]
-	extraheader = AUTHORIZATION: basic eC1hY2Nlc3MtdG9rZW46Z2hzX0NvN3dnY0E3NGZPc1JRODZ5WmtFTm1MR2U3R3M2bjFRVVByWg==
+	extraheader = AUTHORIZATION: basic eC1hY2Nlc3MtdG9rZW46Z2hzX2tYQWhwWTVaa1FyalpaNEpWck9VNkV0VVl0UDZGWTJFNmNsYg==
 [url "https://github.com/"]
 	insteadOf = git@github.com:
 	insteadOf = org-6826477@github.com:

{llama_cpp_python-0.2.71 → llama_cpp_python-0.2.72}/.git/modules/vendor/llama.cpp/modules/kompute/logs/HEAD

@@ -1,2 +1,2 @@
-0000000000000000000000000000000000000000 c339310f6ff914c5b94fb2353f01a33dfc35f64f runner <runner@fv-az979-264.(none)> 1715238249 +0000	clone: from https://github.com/nomic-ai/kompute.git
-c339310f6ff914c5b94fb2353f01a33dfc35f64f 4565194ed7c32d1d2efa32ceab4d3c6cae006306 runner <runner@fv-az979-264.(none)> 1715238250 +0000	checkout: moving from master to 4565194ed7c32d1d2efa32ceab4d3c6cae006306
+0000000000000000000000000000000000000000 c339310f6ff914c5b94fb2353f01a33dfc35f64f runner <runner@fv-az532-278.(none)> 1715317088 +0000	clone: from https://github.com/nomic-ai/kompute.git
+c339310f6ff914c5b94fb2353f01a33dfc35f64f 4565194ed7c32d1d2efa32ceab4d3c6cae006306 runner <runner@fv-az532-278.(none)> 1715317089 +0000	checkout: moving from master to 4565194ed7c32d1d2efa32ceab4d3c6cae006306

{llama_cpp_python-0.2.71 → llama_cpp_python-0.2.72}/.git/modules/vendor/llama.cpp/modules/kompute/logs/refs/heads/master

@@ -1 +1 @@
-0000000000000000000000000000000000000000 c339310f6ff914c5b94fb2353f01a33dfc35f64f runner <runner@fv-az979-264.(none)> 1715238249 +0000	clone: from https://github.com/nomic-ai/kompute.git
+0000000000000000000000000000000000000000 c339310f6ff914c5b94fb2353f01a33dfc35f64f runner <runner@fv-az532-278.(none)> 1715317088 +0000	clone: from https://github.com/nomic-ai/kompute.git

{llama_cpp_python-0.2.71 → llama_cpp_python-0.2.72}/.git/modules/vendor/llama.cpp/modules/kompute/logs/refs/remotes/origin/HEAD

@@ -1 +1 @@
-0000000000000000000000000000000000000000 c339310f6ff914c5b94fb2353f01a33dfc35f64f runner <runner@fv-az979-264.(none)> 1715238249 +0000	clone: from https://github.com/nomic-ai/kompute.git
+0000000000000000000000000000000000000000 c339310f6ff914c5b94fb2353f01a33dfc35f64f runner <runner@fv-az532-278.(none)> 1715317088 +0000	clone: from https://github.com/nomic-ai/kompute.git

llama_cpp_python-0.2.72/.git/modules/vendor/llama.cpp/objects/3c/f84117cf16415f913fc2c483564817ed402c8c

@@ -0,0 +1,2 @@
+x
��Mj�0�}
+A�]�BI��"��i"*��h�4��Z������量
�)��|�_Y��$F��gu&3b�ٳ��Q���V���}{t%�$v�WI�`⢦I��r5��^���w��fM֚��LN��T�8�|��i�w�x��
�	���"�O73WF��>q7���B7��Deߋ5�o���y��7����yo�?/ K��d���PH7�Ҿ�
v~"d

llama_cpp_python-0.2.72/.git/modules/vendor/llama.cpp/objects/e9/026dc81493fe3bebe666b45eb140776b143e61

@@ -0,0 +1 @@
+x
��]k�0�w���`���9j�X��ES�W���+Ԥ����K�u�������=O�)_��N滋�p�
g�6̈́���(�\F	�C��K���Y��Dr1Ts�F�퍡�9.�h�C����yu��֩�`:�3P~wu�	D��ԩ>��eCe׭SY��b�5{�N���9��C�j�����>�c���\4�dO�����@A��#�I&�丐q�](����d�/���=�:Cs.DZ��r�p�K`.h
��|�cĸX�i�C1���av�����\۪�f,�=9��p߳8�zBh���QO�EBsѿM}���y��"���jR�S�>4vop�Π������Y�ȋ%��`ܼ'zd��

llama_cpp_python-0.2.72/.git/modules/vendor/llama.cpp/packed-refs

@@ -0,0 +1,2 @@
+# pack-refs with: peeled fully-peeled sorted 
+8c570c9496212073079476651c7517c02581101f refs/remotes/origin/master

llama_cpp_python-0.2.72/.git/modules/vendor/llama.cpp/refs/heads/master

@@ -0,0 +1 @@
+8c570c9496212073079476651c7517c02581101f

llama_cpp_python-0.2.72/.git/modules/vendor/llama.cpp/refs/tags/b2836

@@ -0,0 +1 @@
+8c570c9496212073079476651c7517c02581101f

{llama_cpp_python-0.2.71 → llama_cpp_python-0.2.72}/.git/modules/vendor/llama.cpp/shallow

@@ -1,2 +1,2 @@
-4426e2987b566f09c7aa96ada9706cc778637620
+8c570c9496212073079476651c7517c02581101f
 911b3900dded9a1cfe0f0e41b82c7a29baf3a217

llama_cpp_python-0.2.72/.git/refs/tags/v0.2.72

@@ -0,0 +1 @@
+4badac3a60c6cef16d1249cae6b0c2af94cb9415

llama_cpp_python-0.2.72/.git/shallow

@@ -0,0 +1 @@
+4badac3a60c6cef16d1249cae6b0c2af94cb9415

{llama_cpp_python-0.2.71 → llama_cpp_python-0.2.72}/CHANGELOG.md

@@ -7,6 +7,11 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ## [Unreleased]
 
+## [0.2.72]
+
+- fix(security): Remote Code Execution by Server-Side Template Injection in Model Metadata by @retr0reg in b454f40a9a1787b2b5659cd2cb00819d983185df
+- fix(security): Update remaining jinja chat templates to use immutable sandbox by @CISC in #1441
+
 ## [0.2.71]
 
 - feat: Update llama.cpp to ggerganov/llama.cpp@911b3900dded9a1cfe0f0e41b82c7a29baf3a217

{llama_cpp_python-0.2.71 → llama_cpp_python-0.2.72}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.1
 Name: llama_cpp_python
-Version: 0.2.71
+Version: 0.2.72
 Summary: Python bindings for the llama.cpp library
 Author-Email: Andrei Betlen <abetlen@gmail.com>
 License: MIT

{llama_cpp_python-0.2.71 → llama_cpp_python-0.2.72}/llama_cpp/__init__.py

@@ -1,4 +1,4 @@
 from .llama_cpp import *
 from .llama import *
 
-__version__ = "0.2.71"
+__version__ = "0.2.72"

{llama_cpp_python-0.2.71 → llama_cpp_python-0.2.72}/llama_cpp/llama.py

@@ -378,6 +378,7 @@ class Llama:
 
         self.chat_format = chat_format
         self.chat_handler = chat_handler
+        self._chat_handlers: Dict[str, llama_chat_format.LlamaChatCompletionHandler] = {}
 
         self.draft_model = draft_model
 
@@ -409,10 +410,33 @@ class Llama:
         if self.verbose:
             print(f"Model metadata: {self.metadata}", file=sys.stderr)
 
+        eos_token_id = int(self.metadata.get("tokenizer.ggml.eos_token_id", self.token_eos()))
+        bos_token_id = int(self.metadata.get("tokenizer.ggml.bos_token_id", self.token_bos()))
+
+        eos_token = self._model.token_get_text(eos_token_id)
+        bos_token = self._model.token_get_text(bos_token_id)
+
+        # Unfortunately the llama.cpp API does not return metadata arrays, so we can't get template names from tokenizer.chat_templates
+        template_choices = dict((name[10:], template) for name, template in self.metadata.items() if name.startswith("tokenizer.chat_template."))
+
+        if "tokenizer.chat_template" in self.metadata:
+            template_choices["chat_template.default"] = self.metadata["tokenizer.chat_template"]
+
+        if self.verbose and template_choices:
+            print(f"Available chat formats from metadata: {', '.join(template_choices.keys())}", file=sys.stderr)
+
+        for name, template in template_choices.items():
+            self._chat_handlers[name] = llama_chat_format.Jinja2ChatFormatter(
+                template=template,
+                eos_token=eos_token,
+                bos_token=bos_token,
+                stop_token_ids=[eos_token_id],
+            ).to_chat_handler()
+
         if (
             self.chat_format is None
             and self.chat_handler is None
-            and "tokenizer.chat_template" in self.metadata
+            and "chat_template.default" in template_choices
         ):
             chat_format = llama_chat_format.guess_chat_format_from_gguf_metadata(
                 self.metadata
@@ -423,30 +447,12 @@ class Llama:
                 if self.verbose:
                     print(f"Guessed chat format: {chat_format}", file=sys.stderr)
             else:
-                template = self.metadata["tokenizer.chat_template"]
-                try:
-                    eos_token_id = int(self.metadata["tokenizer.ggml.eos_token_id"])
-                except:
-                    eos_token_id = self.token_eos()
-                try:
-                    bos_token_id = int(self.metadata["tokenizer.ggml.bos_token_id"])
-                except:
-                    bos_token_id = self.token_bos()
-
-                eos_token = self._model.token_get_text(eos_token_id)
-                bos_token = self._model.token_get_text(bos_token_id)
-
                 if self.verbose:
-                    print(f"Using gguf chat template: {template}", file=sys.stderr)
+                    print(f"Using gguf chat template: {template_choices['chat_template.default']}", file=sys.stderr)
                     print(f"Using chat eos_token: {eos_token}", file=sys.stderr)
                     print(f"Using chat bos_token: {bos_token}", file=sys.stderr)
 
-                self.chat_handler = llama_chat_format.Jinja2ChatFormatter(
-                    template=template,
-                    eos_token=eos_token,
-                    bos_token=bos_token,
-                    stop_token_ids=[eos_token_id],
-                ).to_chat_handler()
+                self.chat_format = "chat_template.default"
 
         if self.chat_format is None and self.chat_handler is None:
             self.chat_format = "llama-2"
@@ -1719,7 +1725,7 @@ class Llama:
         Returns:
             Generated chat completion or a stream of chat completion chunks.
         """
-        handler = self.chat_handler or llama_chat_format.get_chat_completion_handler(
+        handler = self.chat_handler or self._chat_handlers.get(self.chat_format) or llama_chat_format.get_chat_completion_handler(
             self.chat_format
         )
         return handler(

{llama_cpp_python-0.2.71 → llama_cpp_python-0.2.72}/llama_cpp/llama_chat_format.py

@@ -11,6 +11,7 @@ from contextlib import ExitStack
 from typing import Any, Dict, Iterator, List, Literal, Optional, Tuple, Union, Protocol, cast
 
 import jinja2
+from jinja2.sandbox import ImmutableSandboxedEnvironment
 
 import numpy as np
 import numpy.typing as npt
@@ -191,7 +192,7 @@ class Jinja2ChatFormatter(ChatFormatter):
         self.add_generation_prompt = add_generation_prompt
         self.stop_token_ids = set(stop_token_ids) if stop_token_ids is not None else None
 
-        self._environment = jinja2.Environment(
+        self._environment = ImmutableSandboxedEnvironment(
             loader=jinja2.BaseLoader(),
             trim_blocks=True,
             lstrip_blocks=True,
@@ -684,8 +685,7 @@ def hf_tokenizer_config_to_chat_formatter(
     assert isinstance(tokenizer_config["eos_token"], str)
     eos_token = tokenizer_config["eos_token"]
 
-    env = jinja2.Environment(
-        loader=jinja2.BaseLoader(),
+    env = ImmutableSandboxedEnvironment(
         trim_blocks=True,
         lstrip_blocks=True,
     ).from_string(chat_template)
@@ -2602,7 +2602,10 @@ class Llava15ChatHandler:
             messages = [llama_types.ChatCompletionRequestSystemMessage(role="system", content=self.DEFAULT_SYSTEM_MESSAGE)] + messages
 
         image_urls = self.get_image_urls(messages)
-        template = jinja2.Template(self.CHAT_FORMAT)
+        template = ImmutableSandboxedEnvironment(
+            trim_blocks=True,
+            lstrip_blocks=True,
+        ).from_string(self.CHAT_FORMAT)
         text = template.render(
             messages=messages,
             add_generation_prompt=True,
@@ -3241,8 +3244,7 @@ def chatml_function_calling(
         "{% endfor %}"
         "{% if add_generation_prompt %}<|im_start|>assistant\n{% endif %}"
     )
-    template_renderer = jinja2.Environment(
-        loader=jinja2.BaseLoader(),
+    template_renderer = ImmutableSandboxedEnvironment(
         autoescape=jinja2.select_autoescape(["html", "xml"]),
         undefined=jinja2.StrictUndefined,
     ).from_string(function_calling_template)

llama_cpp_python-0.2.71/.git/FETCH_HEAD

@@ -1 +0,0 @@
-bf66a283e899e367c82bdf13b89179fb14ed176e		'bf66a283e899e367c82bdf13b89179fb14ed176e' of https://github.com/abetlen/llama-cpp-python

llama_cpp_python-0.2.71/.git/HEAD

@@ -1 +0,0 @@
-bf66a283e899e367c82bdf13b89179fb14ed176e

llama_cpp_python-0.2.71/.git/logs/HEAD

@@ -1 +0,0 @@
-0000000000000000000000000000000000000000 bf66a283e899e367c82bdf13b89179fb14ed176e runner <runner@fv-az979-264.(none)> 1715238244 +0000	checkout: moving from master to refs/tags/v0.2.71

llama_cpp_python-0.2.71/.git/modules/vendor/llama.cpp/logs/HEAD

@@ -1,2 +0,0 @@
-0000000000000000000000000000000000000000 4426e2987b566f09c7aa96ada9706cc778637620 runner <runner@fv-az979-264.(none)> 1715238247 +0000	clone: from https://github.com/ggerganov/llama.cpp.git
-4426e2987b566f09c7aa96ada9706cc778637620 911b3900dded9a1cfe0f0e41b82c7a29baf3a217 runner <runner@fv-az979-264.(none)> 1715238248 +0000	checkout: moving from master to 911b3900dded9a1cfe0f0e41b82c7a29baf3a217

llama_cpp_python-0.2.71/.git/modules/vendor/llama.cpp/logs/refs/heads/master

@@ -1 +0,0 @@
-0000000000000000000000000000000000000000 4426e2987b566f09c7aa96ada9706cc778637620 runner <runner@fv-az979-264.(none)> 1715238247 +0000	clone: from https://github.com/ggerganov/llama.cpp.git

llama_cpp_python-0.2.71/.git/modules/vendor/llama.cpp/logs/refs/remotes/origin/HEAD

@@ -1 +0,0 @@
-0000000000000000000000000000000000000000 4426e2987b566f09c7aa96ada9706cc778637620 runner <runner@fv-az979-264.(none)> 1715238247 +0000	clone: from https://github.com/ggerganov/llama.cpp.git

llama_cpp_python-0.2.71/.git/modules/vendor/llama.cpp/packed-refs

@@ -1,2 +0,0 @@
-# pack-refs with: peeled fully-peeled sorted 
-4426e2987b566f09c7aa96ada9706cc778637620 refs/remotes/origin/master

llama_cpp_python-0.2.71/.git/modules/vendor/llama.cpp/refs/heads/master

@@ -1 +0,0 @@
-4426e2987b566f09c7aa96ada9706cc778637620

llama_cpp_python-0.2.71/.git/modules/vendor/llama.cpp/refs/tags/b2824

@@ -1 +0,0 @@
-4426e2987b566f09c7aa96ada9706cc778637620

llama_cpp_python-0.2.71/.git/refs/tags/v0.2.71

@@ -1 +0,0 @@
-bf66a283e899e367c82bdf13b89179fb14ed176e

llama_cpp_python-0.2.71/.git/shallow

@@ -1 +0,0 @@
-bf66a283e899e367c82bdf13b89179fb14ed176e