Document EPContext API placement and sample path-safety

Author: Gopalakrishnan Nallasamy

include/onnxruntime/core/session/onnxruntime_c_api.h

@@ -7547,6 +7547,10 @@ struct OrtApi {
    * When loading a compiled model with external (non-embedded) EPContext binary data, an execution provider can
    * retrieve this callback from OrtEpContextConfig and call it instead of reading the binary data from disk.
    *
+   * Reading happens at session load, so this callback is configured on OrtSessionOptions. The corresponding write
+   * callback runs only at compile time and is configured on OrtModelCompilationOptions via
+   * OrtCompileApi::ModelCompilationOptions_SetEpContextDataWriteFunc.
+   *
    * The state pointer is stored as-is and is not owned by ORT. It must remain valid while any session or EP created
    * from these options may call the callback. If the same state may be used by multiple EPs or threads, the application
    * is responsible for synchronization.
@@ -8388,6 +8392,10 @@ struct OrtCompileApi {
    * When EPContext embed mode is disabled, execution providers can retrieve this callback from OrtEpContextConfig and
    * call it instead of writing EPContext binary data directly to disk.
    *
+   * Writing happens only at compile time, so this callback is configured on OrtModelCompilationOptions. The
+   * corresponding read callback runs at session load and is configured on OrtSessionOptions via
+   * OrtApi::SessionOptions_SetEpContextDataReadFunc.
+   *
    * The state pointer is stored as-is and is not owned by ORT. It must remain valid for the duration of the compile
    * operation that may call the callback. If the same state may be used by multiple EPs or threads, the application is
    * responsible for synchronization.

onnxruntime/test/autoep/library/ep_context_data_utils.h

@@ -77,6 +77,11 @@ inline std::string PathToUtf8String(const std::filesystem::path& path) {
 #endif
 }
 
+// NOTE: This sample resolves file_name (which can originate from an untrusted EPContext model's
+// "ep_cache_context" attribute) directly into a filesystem path. An absolute path or one containing ".."
+// segments can therefore escape the model directory. Production EPs that adopt this pattern should validate
+// or sandbox the resolved path (e.g. reject absolute paths and traversal, confine to an allowed directory)
+// and bound the amount of data read.
 inline OrtStatus* ResolveEpContextDataPath(const OrtApi& api, const char* file_name, const OrtGraph* graph,
                                            std::filesystem::path& data_path) {
   data_path.clear();