Patched code sample

# This code is from fickling/analysis.py, patched in version 0.1.7.
# The fix for the vulnerability was to expand the set of modules
# considered unsafe, thus adding more modules to the static analyzer's deny-list.
# The original list was missing several high-risk modules.

UNSAFE_IMPORTS = {
    # This covers os.system
    "os",
    "posix",
    "nt",
    # This covers subprocess.run, etc.
    "subprocess",
    # This covers sys.exit, etc.
    "sys",
    # This covers shutil.rmtree, etc.
    "shutil",
    # This covers pathlib.Path(...).unlink(), etc.
    "pathlib",
    # This covers platform.system(), etc.
    "platform",
    # This covers loading arbitrary libraries
    "ctypes",
    # This covers pickle.loads, which can be used to bypass analysis
    "pickle",
    # This covers urllib.request.urlopen, etc.
    "urllib",
    "urllib.request",
    "urllib.error",
    "urllib.parse",
    # This covers requests.get, etc.
    "requests",
    # This can be used for arbitrary code execution with eval()
    "builtins",
    # This can be used for arbitrary code execution with exec()
    "exec",
    # This can be used for arbitrary code execution with eval()
    "eval",
    # This can be used to import arbitrary modules
    "importlib",
    # This can be used to load arbitrary modules
    "__import__",
    # This can be used to open and read/write files
    "io",
    # This covers socket.socket, etc.
    "socket",
}

# The method that uses this set to check for unsafe imports.
# This method itself was not changed, but its behavior is fixed
# by the expanded UNSAFE_IMPORTS set above.
class StaticAnalyzer:
    def __init__(self, pickle_ops, stack):
        self.imports = set()
        # ... (other initializations) ...
        # In the actual code, `self.imports` is populated by analyzing the pickle data.
        # For this example, we'll add a dummy import that would have been missed.
        self.imports.add(("requests", None)) # Vulnerable version would miss this.
        self.imports.add(("os", None))       # Vulnerable version would catch this.


    def unsafe_imports(self) -> list[tuple[str, str | None]]:
        """
        Checks for imports of modules which are known to be unsafe.
        :return: A list of module/name pairs which are deemed unsafe.
        """
        found = []
        for module, name in self.imports:
            # Check if the module itself is in the unsafe list
            if module in UNSAFE_IMPORTS:
                found.append((module, name))
                continue
            # Check for submodules, e.g. os.path when 'os' is unsafe
            if "." in module:
                base_module = module.split(".", 1)[0]
                if base_module in UNSAFE_IMPORTS:
                    found.append((module, name))
        return found

# Example demonstration:
# In a version prior to 0.1.7, UNSAFE_IMPORTS would not contain 'requests'.
# The fix was to add 'requests' and other modules to the set.

# analyzer = StaticAnalyzer([], [])
# print(f"Detected unsafe imports: {analyzer.unsafe_imports()}")
# With the patched UNSAFE_IMPORTS, the output is:
# Detected unsafe imports: [('requests', None), ('os', None)]