Contain enable_profiling path to model directory (path traversal hardening)

[jiafatom]

Summary

Hardens the enable_profiling field of genai_config.json against path traversal (CWE-22).

The field was read from the (untrusted) model config and passed verbatim to OnnxRuntime's EnableProfiling():

// src/models/model.cpp
fs::path profile_file_prefix{config_session_options.enable_profiling.value()};
session_options.EnableProfiling(profile_file_prefix.c_str());  // honored verbatim

ORT writes a <prefix>_<timestamp>.json profiling file when the session closes. A malicious model package could set e.g. "enable_profiling": "../../../../etc/cron.d/ort" (Linux) or a ...\Startup\evil path (Windows) to write to arbitrary locations.

Fix

• src/models/model.cpp: add ResolveContainedConfigPath, which rejects absolute paths and any parent-directory (..) component, then resolves the profiling prefix relative to the model directory (config_->config_path). Applied at the enable_profiling sink.
• test/model_tests.cpp: add EnableProfilingRejectsPathTraversal and EnableProfilingRejectsAbsolutePath.

The custom fs::path in this repo has no canonicalization primitives, so containment is enforced lexically (reject absolute + ..), which is sufficient to keep the resolved path within the model directory subtree.

Notes / scope

• The host-controlled runtime option (SetRuntimeOption("enable_profiling", ...), model.cpp / State::SetRunOption) is intentionally left unchanged — that path is not attacker-controlled.
• Behavior change: config-sourced relative profiling paths now resolve relative to the model directory (previously the process CWD). This matches how other config paths (e.g. custom_ops_library) resolve and is the contained/expected default.
• As the reporter notes, the co-located custom_ops_library field is a higher-value target but reflects the documented model-package trust boundary; this PR scopes to the enable_profiling hardening.

Testing

New regression tests use the existing OgaConfig::Overlay pattern on tiny-random-gpt2-fp32. Local build isn't available in my environment (root-owned build dir / jiafa-dev container needed); relying on CI to build and run the C++ unit tests.

[Copilot]

Pull request overview

This PR hardens handling of the enable_profiling value sourced from genai_config.json to mitigate path traversal (CWE-22) by rejecting absolute paths / .. components and resolving the profiling prefix relative to the model’s config directory.

Changes:

• Added ResolveContainedConfigPath() and applied it to the config-sourced enable_profiling sink before calling Ort::SessionOptions::EnableProfiling().
• Added C++ regression tests ensuring traversing and absolute enable_profiling values are rejected during model load.

Reviewed changes

Copilot reviewed 2 out of 2 changed files in this pull request and generated 1 comment.

File	Description
src/models/model.cpp	Adds lexical containment validation for config-sourced profiling prefix and resolves it relative to the model directory.
test/model_tests.cpp	Adds regression tests for rejecting traversing and absolute profiling paths from config overlays.

[kunal-vaishnavi]

Same question as here in the other PR