Python: fix(core): restrict unpickler module-prefix allowlist to types only#5923
Python: fix(core): restrict unpickler module-prefix allowlist to types only#5923White-Mouse wants to merge 2 commits into
Conversation
github-actions
Bot
changed the title
|
@microsoft-github-policy-service agree |
There was a problem hiding this comment.
Pull request overview
Tightens the Python checkpoint restricted unpickling boundary by preventing agent_framework.* and openai.types.* module-prefix allowlisting from returning non-type globals (e.g., functions/modules), mitigating gadget chains that can pivot via builtins.getattr.
Changes:
- Updates
_RestrictedUnpickler.find_classto resolve globals under allowed prefixes and permit them only if they are actualtypeobjects. - Adds a dedicated
UnpicklingErrormessage for blocked non-type globals from allowed prefixes.
White-Mouse
force-pushed
the
fix/restricted-unpickler-non-type-globals
branch
from
f514068 to
04d425a
Compare
|
@White-Mouse thanks for your contribution. Is there an open issue we can link to? Additionally, please help to fix the merge conflict. |
White-Mouse
force-pushed
the
fix/restricted-unpickler-non-type-globals
branch
from
04d425a to
b996da1
Compare
Python Test Coverage Report •
Python Unit Test Overview
|
||||||||||||||||||||||||||||||
White-Mouse
force-pushed
the
fix/restricted-unpickler-non-type-globals
branch
from
e255fd1 to
1bc4077
Compare
| if not isinstance(obj, type) or not isinstance(name, str): | ||
| raise pickle.UnpicklingError("Checkpoint deserialization blocked for unsafe attribute traversal.") | ||
|
|
||
| resolved = getattr(obj, name) |
There was a problem hiding this comment.
Could we preserve enum-by-name checkpoints here? enum.pickle_by_enum_name reconstructs a member as getattr(Color, "RED"), so this type-only check now rejects a caller-allowlisted Enum that the base code decodes for protocols 3-5, including protocol 5 written by encode_checkpoint_value. Could the wrapper narrowly accept a real member of an already permitted Enum class while keeping other non-type attributes blocked?
White-Mouse
force-pushed
the
fix/restricted-unpickler-non-type-globals
branch
from
1bc4077 to
9dd038e
Compare
Motivation & Context
The restricted checkpoint decoder allows framework and OpenAI SDK types by module prefix. The previous implementation returned any global from those modules, and the allowlisted
builtins.getattrcould also traverse attributes on an allowed type. Together, those behaviors allowed a crafted pickle to reach a non-type callable such as_RestrictedUnpickler.__init__.__globals__["pickle"].loadsbefore the post-deserialization type check.This change tightens that defense-in-depth path while preserving the checkpoint format and supported type reconstruction.
Description & Review Guide
type. During restricted unpickling,builtins.getattris replaced with a resolver that only permits type-to-type attribute lookup. Regression tests cover non-type globals, legitimate nested-type lookup, and the fullgetattr/__globals__/inner-pickle.loadschain.pickle.UnpicklingError.getattrreplacement and whether the regression coverage captures the expected nested-type reconstruction cases.Related Issue
No issue is linked yet. A maintainer requested an open issue, and this PR will be linked once one is available.
Contribution Checklist
breaking changelabel (or add "[BREAKING]" to the title prefix, before or after any language prefix) — a workflow keeps the label and title prefix in sync automatically.