Python pickle解压时可能存在安全风险

https://www.codebonobo.tech/post/15#Python%20pickle%E8%A7%A3%E5%8E%8B%E6%97%B6%E5%8F%AF%E8%83%BD%E5%AD%98%E5%9C%A8%E5%AE%89%E5%85%A8%E9%A3%8E%E9%99%A9

如果解压对像中有重构的reduce操作, pickle.loads时会执行reduce方法中的内容.

比如:

import io
import os
import pickle

class BadCode(object):
    def __reduce__(self):
        return (os.system, ('echo fuckyou!',))


bc = BadCode()

bbb = pickle.dumps(bc)
pickle.loads(bbb)

限制方法, 重载一下Unpicke方法, 只解压特定类型的对像.

class RestrictedUnpickler(pickle.Unpickler):
    def find_class(self, module, name):
        print(module, name)
        if module == "builtins" and name in {"str", "list", "dict", "set", "int", "float", "bool"}:
            return getattr(__import__(module), name)
        raise pickle.UnpicklingError(f"global '{module}.{name}' is forbidden")
    def load_reduce(self):
        # 禁止使用 reduce
        raise pickle.UnpicklingError("reduce() is not allowed")

def restricted_loads(s):
    return RestrictedUnpickler(io.BytesIO(s)).load()


ok = restricted_loads(bbb)

print('ok: ',ok)