Add `_pickle` module to unsafe globals about picklescan HOT 3 CLOSED

Should the target be _pickle or pickle (no underscore)?

I setup a repro using this:

class Malicious13:
    def __reduce__(self):
        return pickle.loads, (b'I12345\n.',) # Loads the value 12345

This gets serialized (Pickle version 0, on Windows) as:

cpickle
loads
p0
(c_codecs
encode
p1
(VI12345\u000a.
p2
Vlatin1
p3
tp4
Rp5
tp6
Rp7
.

This has cpickle instead of _pickle in the serialized data.

Without the fix, this gets detected as pickle.loads and reported as Suspicious. The fix I am currently testing raises that to Dangerous.

from picklescan.

Not sure why in some cases it serializes as __pickle and others as pickle/cpickle. Can't find the repo anymore, but pretty sure the global was __pickle.

from picklescan.

That looks like a Python 2 - Python 3 compatibility feature. It sounds like in Python 2 the C implementation of pickle was called cPickle and in Python 3 _pickle. When I pickle with version 0, cPickle is written, and with version 4, _pickle is written. Updating the fix to handle both.

from picklescan.