davsclaus commented on code in PR #25899:
URL: https://github.com/apache/camel/pull/25899#discussion_r3889386335
##########
components/camel-ai/camel-huggingface/src/main/java/org/apache/camel/component/huggingface/tasks/AbstractTaskPredictor.java:
##########
@@ -107,6 +107,22 @@ public void setEndpoint(HuggingFaceEndpoint endpoint) {
protected abstract String getPythonScript();
+ /**
+ * Prepends the configured Hugging Face token to the generated handler as
the {@code HF_TOKEN} environment variable
+ * so that every task can load gated or private models. {@code
transformers.pipeline()} reads {@code HF_TOKEN} from
+ * the environment when no explicit token is passed; previously only the
chat task passed a token, so the other
+ * tasks failed with 401 on gated models. The token comes from the {@code
authToken} option or is resolved from an
+ * OAuth profile (see {@link
org.apache.camel.component.huggingface.HuggingFaceProducer}), both surfaced
through
+ * {@code config.getAuthToken()}.
+ */
+ protected String withAuthToken(String pythonScript) {
+ String authToken = config.getAuthToken();
+ if (authToken == null || authToken.isEmpty()) {
+ return pythonScript;
+ }
+ return "import os\nos.environ['HF_TOKEN'] = '" + authToken + "'\n\n" +
pythonScript;
Review Comment:
This builds the Python literal by naive string concatenation. If `authToken`
(or a token resolved from an OAuth profile) contains a single quote, it breaks
out of the string literal and corrupts — or injects into — a script that then
gets executed by the Python engine. This mirrors the existing pattern in
`ChatPredictor.getPythonScript()` (`", token='" + config.getAuthToken() +
"'"`), so it's not new, but this is now the shared path for all 10 tasks, so
it's the right place to fix it.
```suggestion
return "import os\nos.environ['HF_TOKEN'] = '" +
authToken.replace("'", "\\'") + "'\n\n" + pythonScript;
```
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
