rules-tensorflow

Potentially unsafe pattern detected in tensorflow code: "tf.py_function". Review the use case — this may indicate a security risk, a deprecated API, or a misconfiguration. Confirm the write is intentional.

You are using an outdated API for tensorflow. Please upgrade to the newer API.

RISK: allow_pickle=True in numpy.load() or similar calls re-enables Python object deserialization, which executes arbitrary code embedded in the .npy/.npz file. FIX: keep allow_pickle=False (the default since NumPy 1.16.3) and use only structured dtypes. If you need object arrays, validate the source is internal/signed.

RISK: Keras Lambda layers serialize the Python function bytecode inside the model file. Loading such a model from an untrusted source executes that bytecode (CWE-502). FIX: replace Lambda layers with named custom Keras Layer subclasses, which serialize only configuration — not arbitrary code.

RISK: Loading a Keras/SavedModel from an HTTP URL fetches and deserializes untrusted model weights — any model checkpoint can contain malicious Lambda layers or pickle objects that execute on load. FIX: download the artifact to a local path, verify its SHA-256 checksum against a trusted manifest, then load from the local path.

RISK: pickle.load() executes arbitrary Python bytecode during deserialization — loading a model checkpoint or dataset from an untrusted or user-supplied path is a remote-code-execution vector (CWE-502). FIX: use tf.saved_model.load() or keras.models.load_model() for model artifacts; for data, use numpy .npy/.npz or tf.data.TFRecordDataset.