| # Load an untrusted torch.package archive the normal way. No safe flag exists here. | |
| # The archive interns its own module whose top-level code runs when the pickled | |
| # object's class is resolved -> /tmp/MARKER_importtime.txt appears on load. | |
| import os, torch | |
| from torch.package import PackageImporter | |
| m = "evil_importtime.pt" | |
| print("marker before:", os.path.exists("/tmp/MARKER_importtime.txt")) | |
| imp = PackageImporter(m) | |
| obj = imp.load_pickle("data", "obj.pkl") # standard consumer API | |
| print("loaded:", type(obj)) | |
| print("marker after :", os.path.exists("/tmp/MARKER_importtime.txt")) | |
| if os.path.exists("/tmp/MARKER_importtime.txt"): | |
| print(open("/tmp/MARKER_importtime.txt").read()) | |