From 5113a24773c9365a1e1259126e166298518dd395 Mon Sep 17 00:00:00 2001 From: LinZiyuu Date: Sun, 31 May 2026 04:06:42 +0800 Subject: [PATCH] fix: apply inference restriction to SageMaker MME invoke path The SageMaker multi-model custom-invoke route (POST /models/{model}/invoke) is dispatched to SageMakerMMEHandleInfer() without checking the inference API restriction. When --http-restricted-api=inference is configured, the standard HTTP infer, the gRPC infer, and the SageMaker /invocations routes all enforce the required header (the last via the inherited HandleInfer), but the MME invoke route runs inference without it. This mirrors the MME model-repository gap closed in #8686, which did not cover the invoke route. Add the existing RETURN_AND_RESPOND_IF_RESTRICTED(req, RestrictedCategory::INFERENCE) guard at the top of the /invoke branch, matching the base HandleInfer/HandleGenerate handlers and the sibling MME repository branches. No behavior change when no inference restriction is set. Signed-off-by: LinZiyuu --- src/sagemaker_server.cc | 3 +++ 1 file changed, 3 insertions(+) diff --git a/src/sagemaker_server.cc b/src/sagemaker_server.cc index 6037a195ef..a347ff97ff 100644 --- a/src/sagemaker_server.cc +++ b/src/sagemaker_server.cc @@ -199,6 +199,9 @@ SagemakerAPIServer::Handle(evhtp_request_t* req) if (action == "/invoke") { LOG_VERBOSE(1) << "SageMaker request: INVOKE MODEL"; + RETURN_AND_RESPOND_IF_RESTRICTED( + req, RestrictedCategory::INFERENCE); + { std::lock_guard lock(models_list_mutex_); if (sagemaker_models_list_.find(multi_model_name.c_str()) ==