trailofbits / trailofbits/fickling
can't create a safe python class
Open
Nobody has claimed this yet.
- Dominant language
- Python
- Stars
- 670
- Forks
- 77
- PR merge metrics
- No merged PRs in 30d
Description
numpy_poc example has the following class as an example of an unsafe class:
...
class Test(object):
def __init__(self):
self.a = 1
def __reduce__(self):
# Runs the other PoC found in /examples
return (os.system, ("python pytorch_poc.py",))
...
removing the unsafe __reduce__ method from the class is not enough to make it safe:
...
class Test(object):
def __init__(self):
self.a = 1
...
$ python example/numpy_poc.py
...
Is this is_likely_safe?
❌
Is this behavior expected?
Contributor guide
No contributing guide indexed for this repository
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Start with example/numpy_poc.py, especially lines 9-15, and run the shown command after removing reduce. Compare the class behavior with the referenced pytorch_poc.py example and trace why is_likely_safe? still reports an unsafe result. Done when the behavior is explained and the expected handling is established.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- numpy, python, pytorch
- Domain
- machine-learning, security
- Issue type
- Bug
- Difficulty
- 3/5
- Estimated time
- 1-2 days
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 45/100