Spaces:
Sleeping
Sleeping
| # CodeQL configuration for ACE-Step-1.5 | |
| # | |
| # This project is a local Gradio desktop application for music generation | |
| # and LoRA/LoKr fine-tuning. It is NOT a web service exposed to the internet. | |
| # | |
| # CodeQL's py/path-injection query flags Gradio UI component values | |
| # (gr.Textbox, gr.Dropdown, etc.) as "user-provided" taint sources. | |
| # While technically the local user can edit these values, the application | |
| # runs entirely on the user's own machine — the user IS the operator. | |
| # There is no remote attacker surface. | |
| # | |
| # Additionally, all user-provided paths are validated through | |
| # acestep.training.path_safety.safe_path() which performs | |
| # os.path.normpath + startswith checks, but CodeQL does not recognise | |
| # cross-function sanitisers. | |
| # | |
| # We therefore exclude the training and UI modules from path-injection | |
| # analysis to suppress these confirmed false positives. | |
| name: "ACE-Step CodeQL Config" | |
| paths-ignore: | |
| # Training modules — local-only, paths validated via safe_path() | |
| - acestep/training | |
| - acestep/ui | |
| # Third-party vendored code | |
| - acestep/third_parts | |
| - third_party | |