ci: Add model name validation for model management requests (#8672)

Author: pskiran1

qa/L0_input_validation/input_validation_test.py

@@ -1,5 +1,5 @@
 #!/usr/bin/env python
-# Copyright (c) 2024-2025, NVIDIA CORPORATION & AFFILIATES. All rights reserved.
+# Copyright (c) 2024-2026, NVIDIA CORPORATION & AFFILIATES. All rights reserved.
 #
 # Redistribution and use in source and binary forms, with or without
 # modification, are permitted provided that the following conditions
@@ -288,5 +288,76 @@ def inference_helper(model_name, batch_size=1):
         inference_helper(model_name="plan_zero_1_float32_int32", batch_size=8)
 
 
+class ModelNameValidationTest(unittest.TestCase):
+    INVALID_TRAVERSAL_NAMES = [
+        "../etc",
+        "a/../b",
+        "../../etc/passwd",
+        "../../../../etc",
+        "model/..",
+        "..",
+        "/etc/passwd",
+        "model/subdir",
+        "model/",
+        " ..",
+        ".. ",
+    ]
+
+    def test_model_name_invalid_load(self):
+        client = tritongrpcclient.InferenceServerClient("localhost:8001")
+        for model_name in self.INVALID_TRAVERSAL_NAMES:
+            with self.assertRaises(InferenceServerException) as cm:
+                client.load_model(model_name)
+            self.assertIn(
+                "model name must not contain path traversal characters",
+                str(cm.exception),
+                f"Expected traversal rejection for model name: {model_name!r}",
+            )
+
+    def test_model_name_empty_load(self):
+        client = tritongrpcclient.InferenceServerClient("localhost:8001")
+        with self.assertRaises(InferenceServerException) as cm:
+            client.load_model("")
+        self.assertIn("model name must not be empty", str(cm.exception))
+
+    def test_model_name_whitespace_only_load(self):
+        client = tritongrpcclient.InferenceServerClient("localhost:8001")
+        whitespace_names = [" ", "   ", "\t", "\n", "\r", "\f", "\v", " \t \n "]
+        for model_name in whitespace_names:
+            with self.assertRaises(InferenceServerException) as cm:
+                client.load_model(model_name)
+            self.assertIn(
+                "model name must not contain only whitespace",
+                str(cm.exception),
+                f"Expected whitespace-only rejection for model name: {model_name!r}",
+            )
+
+    def test_model_name_invalid_unload(self):
+        # Unload should not trigger traversal check
+        client = tritongrpcclient.InferenceServerClient("localhost:8001")
+        for model_name in self.INVALID_TRAVERSAL_NAMES:
+            try:
+                client.unload_model(model_name)
+            except InferenceServerException as e:
+                self.assertNotIn(
+                    "model name must not contain path traversal characters",
+                    str(e),
+                    f"Unload should not trigger traversal rejection for model name: {model_name!r}",
+                )
+
+    def test_model_name_valid(self):
+        """Verify that a syntactically valid model name is not rejected by
+        the traversal check -- it should fail with a model not found error instead."""
+        client = tritongrpcclient.InferenceServerClient("localhost:8001")
+        with self.assertRaises(InferenceServerException) as cm:
+            client.load_model("nonexistent_model")
+        self.assertNotIn(
+            "path traversal characters",
+            str(cm.exception),
+            "Valid model name should not trigger path traversal rejection",
+        )
+        self.assertIn("failed to poll from model repository", str(cm.exception))
+
+
 if __name__ == "__main__":
     unittest.main()

qa/L0_input_validation/test.sh

@@ -1,5 +1,5 @@
 #!/bin/bash
-# Copyright (c) 2024-2025, NVIDIA CORPORATION & AFFILIATES. All rights reserved.
+# Copyright (c) 2024-2026, NVIDIA CORPORATION & AFFILIATES. All rights reserved.
 #
 # Redistribution and use in source and binary forms, with or without
 # modification, are permitted provided that the following conditions
@@ -175,6 +175,32 @@ if [ $? -ne 0 ]; then
 fi
 set -e
 
+# Model name validation test
+rm -rf test_models ; mkdir -p test_models
+SERVER_LOG="./model_name_validation_server.log"
+CLIENT_LOG="./model_name_validation_client.log"
+SERVER_ARGS="--model-repository=`pwd`/test_models --model-control-mode=explicit --log-verbose=1"
+run_server
+if [ "$SERVER_PID" == "0" ]; then
+    echo -e "\n***\n*** Failed to start $SERVER\n***"
+    cat $SERVER_LOG
+    exit 1
+fi
+
+set +e
+python3 -m pytest -s --junitxml="model_name_validation.report.xml" $TEST_PY::ModelNameValidationTest >> $CLIENT_LOG 2>&1
+
+if [ $? -ne 0 ]; then
+    cat $CLIENT_LOG
+    cat $SERVER_LOG
+    echo -e "\n***\n*** input_validation_test.py::ModelNameValidationTest FAILED. \n***"
+    RET=1
+fi
+set -e
+
+kill $SERVER_PID
+wait $SERVER_PID
+
 if [ $RET -eq 0 ]; then
     echo -e "\n***\n*** Input Validation Test Passed\n***"
 else