TensorRT ONNX external_data symlink PoC
This repository contains a minimal safe proof of concept for a TensorRT ONNX parser issue in tensorrt-cu12==10.16.0.72.
The ONNX model uses external_data for initializer W with location=weights.bin. Inside the model directory, weights.bin is a symlink to a controlled marker file outside the model directory. TensorRT follows the symlink, maps the target file, imports the bytes as tensor weights, builds a serialized engine, and the marker bytes appear inside the engine.
The PoC intentionally uses a controlled marker file (LH870_TRT_SECRET!) instead of reading real system secrets.
Files
poc.zip - Minimal PoC package and 3x reproduction log.sha256.txt - SHA256 checksum for poc.zip.make_external_data_pocs.py - Generates the ONNX external_data fixtures.parse_with_tensorrt.py - Parses/builds the ONNX model with TensorRT.h1_outside_model_dir_build_marker_3x.log - Evidence showing 3/3 successful reproductions.
Expected result
TensorRT should reject symlink external data files or verify that the opened file is a regular file within the model package boundary after filesystem resolution.
Observed result
TensorRT reads and maps weights.bin, follows the symlink to a file outside the model directory, and embeds the controlled marker bytes into the serialized engine.
