Skip to content

Fix failing tests: decimate in chunks and skops - #4792

Merged
chrishalcrow merged 3 commits into
SpikeInterface:mainfrom
alejoe91:fix-failing-tests
Sep 17, 2026
Merged

chrishalcrow merged 3 commits into
SpikeInterface:mainfrom
alejoe91:fix-failing-tests

Conversation

@alejoe91

Copy link
Copy Markdown
Member

Ported here some test fixes from #4713 and #4703

@alejoe91 alejoe91 added the testing Related to test routines label Sep 17, 2026
Comment on lines +476 to +477
untrusted = skio.get_untrusted_types(file=skops_file)
trusted = untrusted

Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

From the scikit-learn warning message:

- sklearn.tree._tree.Tree: sklearn.tree._tree.Tree (the shared node storage for DecisionTree*, RandomForest*, ExtraTrees*, and GradientBoosting* models) stores raw node indices (left_child, right_child, feature) that scikit-learn indexes into without bounds checking. A malicious file can set these to out-of-range values: skops loads the object successfully, but calling .predict() on it can then crash the process (segfault) or read out-of-bounds memory. If you created the file yourself or otherwise fully trust its source, you can load it with trusted=["sklearn.tree._tree.Tree"].
    Only add the specific types you have reviewed and trust to the `trusted` argument; avoid passing everything reported by get_untrusted_types() just to make a file load.

I think it's probably ok, because we force the user to set trust_model = True so it's their responsibility. But it's a bit awkward.

Copy link
Copy Markdown
Member Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

that's the same strategy we had before, I dodn't know there was a function for it so I was parsing the exception...

Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

The idea of the exception was to force users to think for a second before blindly trusting.

@chrishalcrow
chrishalcrow merged commit 029cbe7 into SpikeInterface:main Sep 17, 2026
15 checks passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

testing Related to test routines

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants