Patched code sample

import pickle
import pickletools
import io
import os
import numpy.f2py.crackfortran

# This represents the updated set of dangerous functions in a security scanner
# like picklescan. The vulnerability existed because the set was incomplete.
#
# THE FIX: Add the missing dangerous gadget to the set of unsafe globals.
UNSAFE_GLOBALS_AFTER_FIX = {
    'os.system',
    'subprocess.run',
    'eval',
    'exec',
    # This specific function is dangerous because it uses eval() internally.
    # Adding it to the denylist patches the vulnerability.
    'numpy.f2py.crackfortran._eval_length',
}

def fixed_scanner(pickle_data: bytes):
    """
    A simplified scanner that safely inspects pickle data for dangerous globals
    using the patched (fixed) denylist. It does not load/execute the pickle.
    """
    is_safe = True
    for opcode, arg, _ in pickletools.genops(pickle_data):
        if opcode.name == 'GLOBAL':
            fully_qualified_name = arg
            if fully_qualified_name in UNSAFE_GLOBALS_AFTER_FIX:
                print(f"[!] DETECTED UNSAFE GLOBAL: {fully_qualified_name}")
                is_safe = False
    return is_safe

# --- Demonstration of the fix in action ---

# 1. Craft a malicious payload that exploits the specific vulnerability.
#    This class, when pickled, will instruct the loader to call the dangerous
#    numpy function, leading to code execution.
class MaliciousPayload:
    def __reduce__(self):
        # The vulnerable gadget is called with a command to be executed via eval().
        command_to_execute = b"__import__('os').system('echo EXPLOIT SUCCESSFUL')"
        return (numpy.f2py.crackfortran._eval_length, (command_to_execute,))

# 2. Serialize the malicious payload into a pickle byte string.
malicious_pickle = pickle.dumps(MaliciousPayload())

# 3. Use the fixed scanner to inspect the malicious pickle.
#    The scanner should now correctly identify the dangerous gadget.
print("Scanning malicious pickle with the FIXED scanner...")
if not fixed_scanner(malicious_pickle):
    print("\n[SUCCESS] The fix works: The dangerous gadget was correctly identified and blocked.")
else:
    print("\n[FAILURE] The fix did not work.")

# 4. For comparison, scan a safe pickle.
print("\nScanning a safe pickle with the FIXED scanner...")
safe_pickle = pickle.dumps({"data": [1, 2, 3], "status": "ok"})
if fixed_scanner(safe_pickle):
    print("[SUCCESS] The scanner correctly identified the safe pickle.")