trailofbits / fickling

A Python pickling decompiler and static analyzer
GNU Lesser General Public License v3.0
413 stars 48 forks source link

Add hooks, fickling.load(), and a JSON output format for usability #79

Closed suhacker1 closed 10 months ago

suhacker1 commented 10 months ago

This PR makes multiple feature additions for usability. Specifically, this PR adds a fickling import hook, global function hook, fickling.load() function, and a JSON output format for the check_safety component of the CLI. Each of these features can make it easier to integrate fickling into different codebases and tools.

This PR also updates the examples and tests to reflect these new features. Additional important changes made include:

I would especially appreciate feedback on:

Example JSON Output ("test_unused_variables.json"):

{
    "severity": "OVERTLY_MALICIOUS",
    "analysis": "Call to `eval(b'[5, 6, 7, 8]')` is almost certainly evidence of a malicious pickle file\nVariable `_var0` is assigned value `eval(b'[5, 6, 7, 8]')` but unused afterward; this is suspicious and indicative of a malicious pickle file",
    "detailed_results": {
        "AnalysisResult": {
            "OvertlyBadEval": "eval(b'[5, 6, 7, 8]')",
            "UnusedVariables": [
                "_var0",
                "eval(b'[5, 6, 7, 8]')"
            ]
        }
    }
}
suhacker1 commented 10 months ago

Note: We decided not to include the PyTorch global hook in this PR. We also decided to remove the UNKNOWN severity type as we felt it was redundant.

suhacker1 commented 10 months ago

@Boyan-MILANOV This is ready for another review!