为什么在 find_class 中允许使用受限的 Unpickler 取消自定义类？

Question

我需要重复运行一些代码来训练模型。我发现在代码的一次迭代后使用 pickle 保存我的对象很有用，我可以加载它并在我的第二次迭代中使用它。

但是由于 pickle 存在安全问题，我想使用 restricted_loads 选项。但是我似乎无法让它为自定义类工作。这是我遇到相同错误的一小段代码：

import builtins
import io
import os
import pickle

safe_builtins = {
    'range',
    'complex',
    'set',
    'frozenset',
    'slice',
}

allow_classes = {
    '__main__.Shape'
}

class RestrictedUnpickler(pickle.Unpickler):

    def find_class(self, module, name):
        # Only allow safe classes from builtins.
        if module == "builtins" and name in safe_builtins | allow_classes:
            return getattr(builtins, name)
        # Forbid everything else.
        raise pickle.UnpicklingError("global '%s.%s' is forbidden" %
                                     (module, name))

def restricted_loads(s):
    """Helper function analogous to pickle.loads()."""
    return RestrictedUnpickler(io.BytesIO(s)).load()

class Person:
    def __init__(
        self,
        name: str,
        age: int,
    ):
        self.name = name
        self.age = age

class Shape:
    def __init__(
        self,
        name: Person,
        n: int = 50,
    ):
        self.person = Person(
            name = name,
            age = "10",
        )
        self.n = n
        
s = Shape(
    name = "name1",
    n = 30,
)

filepath = os.path.join(os.getcwd(), "temp.pkl")
with open(filepath, 'wb') as outp:
    pickle.dump(s, outp, -1)
    
with open(filepath, 'rb') as inp:
    x = restricted_loads(inp.read())

错误：

UnpicklingError                           Traceback (most recent call last)
Cell In[20], line 63
     60     pickle.dump(s, outp, -1)
     62 with open(filepath, 'rb') as inp:
---> 63     x = restricted_loads(inp.read())

Cell In[20], line 30, in restricted_loads(s)
     28 def restricted_loads(s):
     29     """Helper function analogous to pickle.loads()."""
---> 30     return RestrictedUnpickler(io.BytesIO(s)).load()

Cell In[20], line 25, in RestrictedUnpickler.find_class(self, module, name)
     23     return getattr(builtins, name)
     24 # Forbid everything else.
---> 25 raise pickle.UnpicklingError("global '%s.%s' is forbidden" %
     26                              (module, name))

UnpicklingError: global '__main__.Shape' is forbidden

Answer 1

您只允许来自模块

builtins

.

的课程

但是

__main__.Shape

是模块

Shape

中名称为

__main__

的类，而不是模块

__main__.Shape

中名称为

builtins

的类。

所以一个明显的解决办法是改变

if module == "builtins" and name in safe_builtins | allow_classes:
    return getattr(builtins, name)

到

if module == "builtins" and name in safe_builtins:
    return getattr(builtins, name)
elif module == "__main__" and name == "Shape":
    return Shape