Vulnerable code sample

import os
import torch
import argparse

def create_parquet_list(data_dir):
    """
    Scans a directory for .pt files (embeddings, tokens) and processes them.
    """
    processed_files = []
    print(f"Scanning directory: {data_dir}")

    for root, _, files in os.walk(data_dir):
        for filename in files:
            if filename.endswith(".pt"):
                file_path = os.path.join(root, filename)
                try:
                    print(f"Processing {file_path}...")
                    # Vulnerable line: Deserializes data from a .pt file.
                    # An attacker can craft a malicious .pt file that executes
                    # arbitrary code when loaded via torch.load, as pickle is used
                    # by default and 'weights_only=True' is not set.
                    data = torch.load(file_path)

                    # Simulate extracting information for the parquet list
                    record = {
                        'path': file_path,
                        'type': 'embedding' if 'embedding' in filename else 'token',
                        'size': data.numel() if hasattr(data, 'numel') else 0
                    }
                    processed_files.append(record)

                except Exception as e:
                    print(f"Error processing {file_path}: {e}")
    
    print("Finished processing.")
    # In a real script, this list would be saved as a parquet file.
    # For example:
    # import pandas as pd
    # df = pd.DataFrame(processed_files)
    # df.to_parquet('output.parquet')
    return processed_files

if __name__ == "__main__":
    parser = argparse.ArgumentParser(
        description="A data processing tool to create a parquet list from .pt files."
    )
    parser.add_argument(
        "data_directory",
        type=str,
        help="The root directory containing the .pt files to process."
    )
    args = parser.parse_args()
    
    if not os.path.isdir(args.data_directory):
        print(f"Error: Directory not found at {args.data_directory}")
    else:
        create_parquet_list(args.data_directory)