()
| 136 | |
| 137 | |
| 138 | def test_pickle(): |
| 139 | import pickle |
| 140 | |
| 141 | class PicklePrint: |
| 142 | def __reduce_ex__(self, p): |
| 143 | return str, ("Pwned!",) |
| 144 | |
| 145 | payload_1 = pickle.dumps(PicklePrint()) |
| 146 | payload_2 = pickle.dumps(("a", "b", "c", 1, 2, 3)) |
| 147 | |
| 148 | # Before we add the hook, ensure our malicious pickle loads |
| 149 | assertEqual("Pwned!", pickle.loads(payload_1)) |
| 150 | |
| 151 | with TestHook(raise_on_events="pickle.find_class") as hook: |
| 152 | with assertRaises(RuntimeError): |
| 153 | # With the hook enabled, loading globals is not allowed |
| 154 | pickle.loads(payload_1) |
| 155 | # pickles with no globals are okay |
| 156 | pickle.loads(payload_2) |
| 157 | |
| 158 | |
| 159 | def test_monkeypatch(): |
nothing calls this directly
no test coverage detected
searching dependent graphs…