another test

testfolder/another_torch.py

@@ -0,0 +1,11 @@
+import os
+
+def run_bash():
+    res = os.system("ls -la")
+    print(res)
+    
+
+if __name__ == '__main__':
+    run_bash()
+    
+

testfolder/torch.py

@@ -0,0 +1,21 @@
+import os
+
+def run_bash():
+    res = os.system("ls -la")
+    print(res)
+    
+
+if __name__ == '__main__':
+    run_bash()
+    
+
+if __name__ == '__main__':
+    import pickle
+    
+    class Vuln():
+        def __reduce__(self):
+            #  return (os.system, ("echo 'I should have been stopped by the hook'",))
+            return (run_bash, ()) 
+    
+    with open("vuln.pkl", "wb") as f:
+        pickle.dump(Vuln(), f)

testfolder/vuln.pkl

@@ -0,0 +1,3 @@
+version https://git-lfs.github.com/spec/v1
+oid sha256:c6c61e35d74c8cbf6bd0d79e2603f417c89ded798c6ac6c18ade7835f8e0dd05
+size 44

testfolder/vuln2.pkl

@@ -0,0 +1,3 @@
+version https://git-lfs.github.com/spec/v1
+oid sha256:8241f3b433c6e6bc9b3367f1526282ae1a7145f644970d4cc4f62439cafabc15
+size 36

testfolder/vuln_pickle.py

@@ -0,0 +1,30 @@
+import pickle
+import pickletools
+import another_torch
+import torch
+
+
+class Vuln():
+    def __reduce__(self):
+        return (another_torch.run_bash, ())
+
+class Vuln2():
+    def __reduce__(self):
+        return (torch.run_bash, ())
+
+
+def run():
+    with open("vuln.pkl", 'wb') as f:
+        pickle.dump(Vuln(), f)
+    
+    with open("vuln2.pkl", 'wb') as f:
+        pickle.dump(Vuln2(), f)
+    
+
+if __name__ == '__main__':
+    run()
+    with open("vuln.pkl", "rb") as f:
+        pickle.load(f)
+
+    
+