transformers - 💡(How to fix) Fix Code quality scan: 164 findings (A-, 84/100)

Hi @huggingface, an automated scan of this repository surfaced 164 code-quality findings that may be worth a look. Full details, severity filters, and per-file context are at the link below — feel free to close this issue if it isn't useful to you.

Full interactive report

https://repobility.com/scan/27ddd460-787e-4a71-a753-7f661c746582/

At a glance

• Score: 84/100 • Grade: A-
• Scanned: 2026-05-17 20:10 UTC
• Lines of code: 1,740,177
• Total findings: 164
• Security-tagged: 11
• Credential / secret patterns: 3

Top issues, with file & line

These are deterministic rule-based findings — the file paths and line numbers below are real and can be verified in your tree.

1. [high] [SEC029] Server-Side Request Forgery (SSRF) — outbound HTTP from user input: Outbound HTTP request to a user-controlled URL without allowlist validation. Attackers can probe internal services (169.254.169.254 metadata, internal Kubernetes endpoints, file:// URIs), exfiltrate data, or pivot through your network. SSRF is OWASP A10:2021 and a frequent foothold in cloud breaches. — src/transformers/models/audio_spectrogram_transformer/convert_audio_spectrogram_transformer_original_to_pytorch.py:187 Validate the URL against an allowlist BEFORE fetching: ALLOWED = {'images.example.com', 'cdn.example.com'} host = urlparse(url).hostname if host not in ALLOWED: abort(400)…
2. [high] [SEC029] Server-Side Request Forgery (SSRF) — outbound HTTP from user input: Outbound HTTP request to a user-controlled URL without allowlist validation. Attackers can probe internal services (169.254.169.254 metadata, internal Kubernetes endpoints, file:// URIs), exfiltrate data, or pivot through your network. SSRF is OWASP A10:2021 and a frequent foothold in cloud breaches. — src/transformers/models/beit/convert_beit_unilm_to_pytorch.py:243 Validate the URL against an allowlist BEFORE fetching: ALLOWED = {'images.example.com', 'cdn.example.com'} host = urlparse(url).hostname if host not in ALLOWED: abort(400)…
3. [high] [SEC035] Unbounded Resource Allocation — DoS risk: Allocating resources (buffers, recursion stack, large ranges) based on user input without an upper bound. Attackers send size=10000000 to exhaust memory, or trigger expensive computation. CWE-770/400. Examples: CVE-2023-44487 (HTTP/2 Rapid Reset), countless YAML/XML billion-laughs variants. — examples/pytorch/image-pretraining/run_mim_no_trainer.py:670 Cap user-controlled sizes BEFORE allocation: size = min(int(request.args.get('n', 100)), MAX_SIZE) Set framework-level limits: Flask: app.config['MAX_CONTENT_LENGTH'] = 1…
4. [high] [SEC029] Server-Side Request Forgery (SSRF) — outbound HTTP from user input: Outbound HTTP request to a user-controlled URL without allowlist validation. Attackers can probe internal services (169.254.169.254 metadata, internal Kubernetes endpoints, file:// URIs), exfiltrate data, or pivot through your network. SSRF is OWASP A10:2021 and a frequent foothold in cloud breaches. — src/transformers/integrations/integration_utils.py:2562 Validate the URL against an allowlist BEFORE fetching: ALLOWED = {'images.example.com', 'cdn.example.com'} host = urlparse(url).hostname if host not in ALLOWED: abort(400)…
5. [high] Dockerfile copies the entire context without .dockerignore — docker/transformers-gpu/Dockerfile:27 Create .dockerignore before using broad context copies, or copy only the required files and directories.

See all 164 findings, with severity filters and AI fix prompts: https://repobility.com/scan/27ddd460-787e-4a71-a753-7f661c746582/

What is this? Repobility is a research project that scans public repositories with a multi-layer static analyzer (rule-based, no AI hallucinations) and learns code-quality patterns across a broad cross-repo corpus. This is not a sales pitch — there's no paywall, no signup required to view the report, and no payment ask. If the findings aren't useful, please close this issue and we won't post again.

To re-run after fixes land: paste your repo URL at repobility.com — fresh scan, free.

Issue filed via the public Repobility report at https://repobility.com/scan/27ddd460-787e-4a71-a753-7f661c746582/.