Skip to content
Closed
Show file tree
Hide file tree
Changes from 2 commits
Commits
File filter

Filter by extension

Filter by extension

Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
1 change: 1 addition & 0 deletions fickling/fickle.py
Original file line number Diff line number Diff line change
Expand Up @@ -768,6 +768,7 @@ def unsafe_imports(self) -> Iterator[Union[ast.Import, ast.ImportFrom]]:
"builtins",
"os",
"posix",
"pty",
"nt",
"subprocess",
"sys",
Expand Down
6 changes: 6 additions & 0 deletions test/test_hook.py
Original file line number Diff line number Diff line change
Expand Up @@ -39,13 +39,19 @@ def __reduce__(self):
return (os.system, ("echo 'I should have been stopped by the hook'",))

payload = Payload()
# Validate that pty-based execution is captured
payload_pty = b'''(cpty\nspawn\nS"id"\no.'''


# Save the payload in a pickle file
with open("unsafe.pickle", "wb") as f:
pickle.dump(payload, f)
with open("unsafe_pty.pickle", "wb") as f:
f.write(payload_pty)

try:
numpy.load("unsafe.pickle", allow_pickle=True)
numpy.load("unsafe_pty.pickle", allow_pickle=True)
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Might be missing something, but shouldn't this be in its own test/try-except block at a minimum? I believe as-is the first line will always trip the exception, so this will never be tested.

except UnpicklingError as e:
if isinstance(e.__cause__, UnsafeFileError):
pass
Expand Down