fix: stop unpickling arbitrary objects from uploaded pose files
#1
by rtrm HF Staff - opened
load_pose_pickle() called pickle.load() on the user-uploaded .pkl file. A crafted pickle runs arbitrary code in the ZeroGPU worker when resolve_pose() runs, through the UI or the /resolve API endpoint. The file_types=[".pkl"] filter is client-side only and does not protect the API.
This change loads the file with a restricted pickle.Unpickler that only allows the numpy globals a pose file needs (_reconstruct, scalar, ndarray, dtype). Any other global raises UnpicklingError. The upload format does not change: the three example poses (x_ori_210/408/436.pkl) load with the same keys, shapes and dtypes as before.
The Space is paused by the HF security team until this is merged.
rtrm changed pull request status to open