import{S as ac,i as rc,s as nc,e as s,k as c,w as T,t as r,N as pc,c as i,d as e,m as f,a as o,x as y,h as n,b as h,P as oc,G as t,g as p,y as u,L as hc,q as U,o as w,B as M,v as cc}from"../chunks/vendor-hf-doc-builder.js";import{I as O}from"../chunks/IconCopyLink-hf-doc-builder.js";import{C as Z}from"../chunks/CodeBlock-hf-doc-builder.js";function fc(bn){let j,ws,Q,Y,ot,kl,Uo,at,wo,Ms,Ue,Mo,Js,v,Jo,rt,mo,ko,Ol,nt,Oo,Io,ds,_,L,pt,Il,vo,ht,Ao,ms,H,Co,vl,Eo,bo,ks,we,Al,Do,ct,go,jo,Os,Me,Qo,Is,Je,_o,vs,de,Ro,As,me,No,Cs,Cl,Es,ke,Fo,bs,El,Ds,A,$o,bl,Vo,Bo,ft,Tt,xo,So,gs,Oe,Po,js,R,X,yt,Dl,Go,ut,Wo,Qs,Ie,zo,_s,ve,Zo,Rs,gl,Ns,q,Yo,Ut,Lo,Ho,Fs,jl,$s,Ae,Xo,Vs,Ce,qo,Bs,Ql,xs,C,Ko,_l,la,ea,wt,ta,sa,Ss,K,ia,Mt,oa,aa,Ps,Rl,Gs,Ee,ra,Ws,Nl,zs,be,na,Zs,Fl,Ys,d,pa,Jt,ha,ca,dt,fa,Ta,mt,ya,ua,Ls,I,kt,Ua,wa,Ot,Ma,Ja,It,da,ma,Hs,De,ka,Xs,E,vt,Oa,Ia,N,va,At,Aa,Ca,Ct,Ea,ba,Da,Et,ga,qs,ge,ja,Ks,F,ll,bt,$l,Qa,Dt,_a,li,je,gt,jt,Ra,ei,Qe,Na,ti,_e,Fa,si,$,el,Qt,Vl,$a,_t,Va,ii,b,Ba,Re,xa,Sa,Rt,Pa,Ga,oi,Ne,Wa,ai,V,tl,Nt,Bl,za,Ft,Za,ri,m,Ya,$t,La,Ha,Vt,Xa,qa,Bt,Ka,lr,ni,Fe,er,pi,xl,hi,B,sl,xt,Sl,tr,St,sr,ci,J,Pt,Pl,ir,or,Gt,Gl,ar,rr,Wt,Wl,nr,pr,zt,zl,hr,cr,Zt,Zl,fr,fi,il,Tr,Yt,yr,ur,Ti,x,ol,Lt,Yl,Ur,$e,wr,Ht,Mr,yi,al,Jr,Ll,dr,mr,ui,S,rl,Xt,Hl,kr,qt,Or,Ui,P,nl,Kt,Xl,Ir,ls,vr,wi,Ve,Ar,Mi,pl,es,Cr,Er,ts,br,Ji,hl,Dr,ql,gr,jr,di,cl,Qr,ss,_r,Rr,mi,Be,Nr,ki,G,xe,Dn,Fr,Se,gn,Oi,fl,$r,Kl,is,Vr,Br,Ii,D,xr,os,Sr,Pr,as,Gr,Wr,vi,le,rs,ns,zr,Zr,Ai,W,Tl,ps,ee,Yr,hs,Lr,Ci,k,Hr,te,Xr,qr,se,Kr,ln,ie,en,tn,Ei,yl,sn,cs,on,an,bi,ul,rn,fs,nn,pn,Di,Ul,hn,Ts,cn,fn,gi,wl,Tn,ys,yn,un,ji,z,Ml,us,oe,Un,Us,wn,Qi,Pe,ae,Mn,_i,Ge,re,Jn,Ri,We,ne,dn,Ni,ze,pe,mn,Fi,Ze,he,kn,$i,Ye,ce,On,Vi,Le,fe,In,Bi,He,Te,vn,xi,Xe,ye,An,Si;return kl=new O({}),Il=new O({}),Cl=new Z({props:{code:"aW1wb3J0JTIwcGlja2xlJTBBaW1wb3J0JTIwcGlja2xldG9vbHMlMEElMEF2YXIlMjAlM0QlMjAlMjJkYXRhJTIwSSUyMHdhbnQlMjB0byUyMHNoYXJlJTIwd2l0aCUyMGElMjBmcmllbmQlMjIlMEElMEElMjMlMjBzdG9yZSUyMHRoZSUyMHBpY2tsZSUyMGRhdGElMjBpbiUyMGElMjBmaWxlJTIwbmFtZWQlMjAncGF5bG9hZC5wa2wnJTBBd2l0aCUyMG9wZW4oJ3BheWxvYWQucGtsJyUyQyUyMCd3YicpJTIwYXMlMjBmJTNBJTBBJTIwJTIwJTIwJTIwcGlja2xlLmR1bXAodmFyJTJDJTIwZiklMEElMEElMjMlMjBkaXNhc3NlbWJsZSUyMHRoZSUyMHBpY2tsZSUwQSUyMyUyMGFuZCUyMHByaW50JTIwdGhlJTIwaW5zdHJ1Y3Rpb25zJTIwdG8lMjB0aGUlMjBjb21tYW5kJTIwbGluZSUwQXdpdGglMjBvcGVuKCdwYXlsb2FkLnBrbCclMkMlMjAncmInKSUyMGFzJTIwZiUzQSUwQSUyMCUyMCUyMCUyMHBpY2tsZXRvb2xzLmRpcyhmKQ==",highlighted:`<span class="hljs-keyword">import</span> pickle
<span class="hljs-keyword">import</span> pickletools

var = <span class="hljs-string">&quot;data I want to share with a friend&quot;</span>

<span class="hljs-comment"># store the pickle data in a file named &#x27;payload.pkl&#x27;</span>
<span class="hljs-keyword">with</span> <span class="hljs-built_in">open</span>(<span class="hljs-string">&#x27;payload.pkl&#x27;</span>, <span class="hljs-string">&#x27;wb&#x27;</span>) <span class="hljs-keyword">as</span> f:
    pickle.dump(var, f)

<span class="hljs-comment"># disassemble the pickle</span>
<span class="hljs-comment"># and print the instructions to the command line</span>
<span class="hljs-keyword">with</span> <span class="hljs-built_in">open</span>(<span class="hljs-string">&#x27;payload.pkl&#x27;</span>, <span class="hljs-string">&#x27;rb&#x27;</span>) <span class="hljs-keyword">as</span> f:
    pickletools.dis(f)`}}),El=new Z({props:{code:"JTIwJTIwJTIwJTIwMCUzQSUyMCU1Q3g4MCUyMFBST1RPJTIwJTIwJTIwJTIwJTIwJTIwNCUwQSUyMCUyMCUyMCUyMDIlM0ElMjAlNUN4OTUlMjBGUkFNRSUyMCUyMCUyMCUyMCUyMCUyMDQ4JTBBJTIwJTIwJTIwMTElM0ElMjAlNUN4OGMlMjBTSE9SVF9CSU5VTklDT0RFJTIwJ2RhdGElMjBJJTIwd2FudCUyMHRvJTIwc2hhcmUlMjB3aXRoJTIwYSUyMGZyaWVuZCclMEElMjAlMjAlMjA1NyUzQSUyMCU1Q3g5NCUyME1FTU9JWkUlMjAlMjAlMjAlMjAoYXMlMjAwKSUwQSUyMCUyMCUyMDU4JTNBJTIwLiUyMCUyMCUyMCUyMFNUT1AlMEFoaWdoZXN0JTIwcHJvdG9jb2wlMjBhbW9uZyUyMG9wY29kZXMlMjAlM0QlMjA0",highlighted:`    <span class="hljs-number">0</span>: \\x80 PROTO      <span class="hljs-number">4</span>
    <span class="hljs-number">2</span>: \\x95 FRAME      <span class="hljs-number">48</span>
   <span class="hljs-number">11</span>: \\x8c SHORT_BINUNICODE <span class="hljs-string">&#x27;data I want to share with a friend&#x27;</span>
   <span class="hljs-number">57</span>: \\x94 MEMOIZE    (<span class="hljs-keyword">as</span> <span class="hljs-number">0</span>)
   <span class="hljs-number">58</span>: .    STOP
highest protocol among opcodes = <span class="hljs-number">4</span>`}}),Dl=new O({}),gl=new Z({props:{code:"aW1wb3J0JTIwcGlja2xlJTBBaW1wb3J0JTIwcGlja2xldG9vbHMlMEElMEFjbGFzcyUyMERhdGElM0ElMEElMjAlMjAlMjAlMjBkZWYlMjBfX2luaXRfXyhzZWxmJTJDJTIwaW1wb3J0YW50X3N0dWZmJTNBJTIwc3RyKSUzQSUwQSUyMCUyMCUyMCUyMCUyMCUyMCUyMCUyMHNlbGYuaW1wb3J0YW50X3N0dWZmJTIwJTNEJTIwaW1wb3J0YW50X3N0dWZmJTBBJTBBZCUyMCUzRCUyMERhdGEoJTIyNDIlMjIpJTBBJTBBd2l0aCUyMG9wZW4oJ3BheWxvYWQucGtsJyUyQyUyMCd3YicpJTIwYXMlMjBmJTNBJTBBJTIwJTIwJTIwJTIwcGlja2xlLmR1bXAoZCUyQyUyMGYp",highlighted:`<span class="hljs-keyword">import</span> pickle
<span class="hljs-keyword">import</span> pickletools

<span class="hljs-keyword">class</span> <span class="hljs-title class_">Data</span>:
    <span class="hljs-keyword">def</span> <span class="hljs-title function_">__init__</span>(<span class="hljs-params">self, important_stuff: <span class="hljs-built_in">str</span></span>):
        self.important_stuff = important_stuff

d = Data(<span class="hljs-string">&quot;42&quot;</span>)

<span class="hljs-keyword">with</span> <span class="hljs-built_in">open</span>(<span class="hljs-string">&#x27;payload.pkl&#x27;</span>, <span class="hljs-string">&#x27;wb&#x27;</span>) <span class="hljs-keyword">as</span> f:
    pickle.dump(d, f)`}}),jl=new Z({props:{code:"JTBBJTIzJTIwY2F0JTIwcGF5bG9hZC5wa2wlMEFfX21haW5fX0RhdGEpJTdEaW1wb3J0YW50X3N0dWZmNDJzYi4lMjUlMEElMEElMjMlMjBoZXh5bCUyMHBheWxvYWQucGtsJTBBJUUyJTk0JThDJUUyJTk0JTgwJUUyJTk0JTgwJUUyJTk0JTgwJUUyJTk0JTgwJUUyJTk0JTgwJUUyJTk0JTgwJUUyJTk0JTgwJUUyJTk0JTgwJUUyJTk0JUFDJUUyJTk0JTgwJUUyJTk0JTgwJUUyJTk0JTgwJUUyJTk0JTgwJUUyJTk0JTgwJUUyJTk0JTgwJUUyJTk0JTgwJUUyJTk0JTgwJUUyJTk0JTgwJUUyJTk0JTgwJUUyJTk0JTgwJUUyJTk0JTgwJUUyJTk0JTgwJUUyJTk0JTgwJUUyJTk0JTgwJUUyJTk0JTgwJUUyJTk0JTgwJUUyJTk0JTgwJUUyJTk0JTgwJUUyJTk0JTgwJUUyJTk0JTgwJUUyJTk0JTgwJUUyJTk0JTgwJUUyJTk0JTgwJUUyJTk0JTgwJUUyJTk0JUFDJUUyJTk0JTgwJUUyJTk0JTgwJUUyJTk0JTgwJUUyJTk0JTgwJUUyJTk0JTgwJUUyJTk0JTgwJUUyJTk0JTgwJUUyJTk0JTgwJUUyJTk0JTgwJUUyJTk0JTgwJUUyJTk0JTgwJUUyJTk0JTgwJUUyJTk0JTgwJUUyJTk0JTgwJUUyJTk0JTgwJUUyJTk0JTgwJUUyJTk0JTgwJUUyJTk0JTgwJUUyJTk0JTgwJUUyJTk0JTgwJUUyJTk0JTgwJUUyJTk0JTgwJUUyJTk0JTgwJUUyJTk0JTgwJUUyJTk0JTgwJUUyJTk0JUFDJUUyJTk0JTgwJUUyJTk0JTgwJUUyJTk0JTgwJUUyJTk0JTgwJUUyJTk0JTgwJUUyJTk0JTgwJUUyJTk0JTgwJUUyJTk0JTgwJUUyJTk0JUFDJUUyJTk0JTgwJUUyJTk0JTgwJUUyJTk0JTgwJUUyJTk0JTgwJUUyJTk0JTgwJUUyJTk0JTgwJUUyJTk0JTgwJUUyJTk0JTgwJUUyJTk0JTkwJTBBJUUyJTk0JTgyMDAwMDAwMDAlRTIlOTQlODIlMjA4MCUyMDA0JTIwOTUlMjAzMyUyMDAwJTIwMDAlMjAwMCUyMDAwJTIwJUUyJTk0JThBJTIwMDAlMjAwMCUyMDAwJTIwOGMlMjAwOCUyMDVmJTIwNWYlMjA2ZCUyMCVFMiU5NCU4MiVDMyU5NyVFMiU4MCVBMiVDMyU5NzMwMDAwJUUyJTk0JThBMDAwJUMzJTk3JUUyJTgwJUEyX19tJUUyJTk0JTgyJTBBJUUyJTk0JTgyMDAwMDAwMTAlRTIlOTQlODIlMjA2MSUyMDY5JTIwNmUlMjA1ZiUyMDVmJTIwOTQlMjA4YyUyMDA0JTIwJUUyJTk0JThBJTIwNDQlMjA2MSUyMDc0JTIwNjElMjA5NCUyMDkzJTIwOTQlMjAyOSUyMCVFMiU5NCU4MmFpbl9fJUMzJTk3JUMzJTk3JUUyJTgwJUEyJUUyJTk0JThBRGF0YSVDMyU5NyVDMyU5NyVDMyU5NyklRTIlOTQlODIlMEElRTIlOTQlODIwMDAwMDAyMCVFMiU5NCU4MiUyMDgxJTIwOTQlMjA3ZCUyMDk0JTIwOGMlMjAwZiUyMDY5JTIwNmQlMjAlRTIlOTQlOEElMjA3MCUyMDZmJTIwNzIlMjA3NCUyMDYxJTIwNmUlMjA3NCUyMDVmJTIwJUUyJTk0JTgyJUMzJTk3JUMzJTk3JTdEJUMzJTk3JUMzJTk3JUUyJTgwJUEyaW0lRTIlOTQlOEFwb3J0YW50XyVFMiU5NCU4MiUwQSVFMiU5NCU4MjAwMDAwMDMwJUUyJTk0JTgyJTIwNzMlMjA3NCUyMDc1JTIwNjYlMjA2NiUyMDk0JTIwOGMlMjAwMiUyMCVFMiU5NCU4QSUyMDM0JTIwMzIlMjA5NCUyMDczJTIwNjIlMjAyZSUyMCUyMCUyMCUyMCUyMCUyMCUyMCVFMiU5NCU4MnN0dWZmJUMzJTk3JUMzJTk3JUUyJTgwJUEyJUUyJTk0JThBNDIlQzMlOTdzYi4lMjAlMjAlRTIlOTQlODIlMEElRTIlOTQlOTQlRTIlOTQlODAlRTIlOTQlODAlRTIlOTQlODAlRTIlOTQlODAlRTIlOTQlODAlRTIlOTQlODAlRTIlOTQlODAlRTIlOTQlODAlRTIlOTQlQjQlRTIlOTQlODAlRTIlOTQlODAlRTIlOTQlODAlRTIlOTQlODAlRTIlOTQlODAlRTIlOTQlODAlRTIlOTQlODAlRTIlOTQlODAlRTIlOTQlODAlRTIlOTQlODAlRTIlOTQlODAlRTIlOTQlODAlRTIlOTQlODAlRTIlOTQlODAlRTIlOTQlODAlRTIlOTQlODAlRTIlOTQlODAlRTIlOTQlODAlRTIlOTQlODAlRTIlOTQlODAlRTIlOTQlODAlRTIlOTQlODAlRTIlOTQlODAlRTIlOTQlODAlRTIlOTQlODAlRTIlOTQlQjQlRTIlOTQlODAlRTIlOTQlODAlRTIlOTQlODAlRTIlOTQlODAlRTIlOTQlODAlRTIlOTQlODAlRTIlOTQlODAlRTIlOTQlODAlRTIlOTQlODAlRTIlOTQlODAlRTIlOTQlODAlRTIlOTQlODAlRTIlOTQlODAlRTIlOTQlODAlRTIlOTQlODAlRTIlOTQlODAlRTIlOTQlODAlRTIlOTQlODAlRTIlOTQlODAlRTIlOTQlODAlRTIlOTQlODAlRTIlOTQlODAlRTIlOTQlODAlRTIlOTQlODAlRTIlOTQlODAlRTIlOTQlQjQlRTIlOTQlODAlRTIlOTQlODAlRTIlOTQlODAlRTIlOTQlODAlRTIlOTQlODAlRTIlOTQlODAlRTIlOTQlODAlRTIlOTQlODAlRTIlOTQlQjQlRTIlOTQlODAlRTIlOTQlODAlRTIlOTQlODAlRTIlOTQlODAlRTIlOTQlODAlRTIlOTQlODAlRTIlOTQlODAlRTIlOTQlODAlRTIlOTQlOTg=",highlighted:`
<span class="hljs-comment"># cat payload.pkl</span>
__main__Data)}important_stuff42sb.%

<span class="hljs-comment"># hexyl payload.pkl</span>
\u250C\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u252C\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u252C\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u252C\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u252C\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2510
\u250200000000\u2502 80 04 95 33 00 00 00 00 \u250A 00 00 00 8c 08 5f 5f 6d \u2502\xD7\u2022\xD730000\u250A000\xD7\u2022__m\u2502
\u250200000010\u2502 61 69 6e 5f 5f 94 8c 04 \u250A 44 61 74 61 94 93 94 29 \u2502ain__\xD7\xD7\u2022\u250AData\xD7\xD7\xD7)\u2502
\u250200000020\u2502 81 94 7d 94 8c 0f 69 6d \u250A 70 6f 72 74 61 6e 74 5f \u2502\xD7\xD7}\xD7\xD7\u2022im\u250Aportant_\u2502
\u250200000030\u2502 73 74 75 66 66 94 8c 02 \u250A 34 32 94 73 62 2e       \u2502stuff\xD7\xD7\u2022\u250A42\xD7sb.  \u2502
\u2514\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2534\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2534\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2534\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2534\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2518`}}),Ql=new Z({props:{code:"ZnJvbSUyMGZpY2tsaW5nLnBpY2tsZSUyMGltcG9ydCUyMFBpY2tsZWQlMEFpbXBvcnQlMjBwaWNrbGUlMEElMEElMjMlMjBDcmVhdGUlMjBhJTIwbWFsaWNpb3VzJTIwcGlja2xlJTBBZGF0YSUyMCUzRCUyMCUyMm15JTIwZnJpZW5kJTIwbmVlZHMlMjB0byUyMGtub3clMjB0aGlzJTIyJTBBJTBBcGlja2xlX2JpbiUyMCUzRCUyMHBpY2tsZS5kdW1wcyhkYXRhKSUwQSUwQXAlMjAlM0QlMjBQaWNrbGVkLmxvYWQocGlja2xlX2JpbiklMEElMEFwLmluc2VydF9weXRob25fZXhlYygncHJpbnQoJTIyeW91JTVDJ3ZlJTIwYmVlbiUyMHB3bmVkJTIwISUyMiknKSUwQSUwQXdpdGglMjBvcGVuKCdwYXlsb2FkLnBrbCclMkMlMjAnd2InKSUyMGFzJTIwZiUzQSUwQSUyMCUyMCUyMCUyMHAuZHVtcChmKSUwQSUwQSUyMyUyMGlubm9jZW50bHklMjB1bnBpY2tsZSUyMGFuZCUyMGdldCUyMHlvdXIlMjBmcmllbmQncyUyMGRhdGElMEF3aXRoJTIwb3BlbigncGF5bG9hZC5wa2wnJTJDJTIwJ3JiJyklMjBhcyUyMGYlM0ElMEElMjAlMjAlMjAlMjBkYXRhJTIwJTNEJTIwcGlja2xlLmxvYWQoZiklMEElMjAlMjAlMjAlMjBwcmludChkYXRhKQ==",highlighted:`<span class="hljs-keyword">from</span> fickling.pickle <span class="hljs-keyword">import</span> Pickled
<span class="hljs-keyword">import</span> pickle

<span class="hljs-comment"># Create a malicious pickle</span>
data = <span class="hljs-string">&quot;my friend needs to know this&quot;</span>

pickle_bin = pickle.dumps(data)

p = Pickled.load(pickle_bin)

p.insert_python_exec(<span class="hljs-string">&#x27;print(&quot;you\\&#x27;ve been pwned !&quot;)&#x27;</span>)

<span class="hljs-keyword">with</span> <span class="hljs-built_in">open</span>(<span class="hljs-string">&#x27;payload.pkl&#x27;</span>, <span class="hljs-string">&#x27;wb&#x27;</span>) <span class="hljs-keyword">as</span> f:
    p.dump(f)

<span class="hljs-comment"># innocently unpickle and get your friend&#x27;s data</span>
<span class="hljs-keyword">with</span> <span class="hljs-built_in">open</span>(<span class="hljs-string">&#x27;payload.pkl&#x27;</span>, <span class="hljs-string">&#x27;rb&#x27;</span>) <span class="hljs-keyword">as</span> f:
    data = pickle.load(f)
    <span class="hljs-built_in">print</span>(data)`}}),Rl=new Z({props:{code:"eW91J3ZlJTIwYmVlbiUyMHB3bmVkJTIwISUwQW15JTIwZnJpZW5kJTIwbmVlZHMlMjB0byUyMGtub3clMjB0aGlz",highlighted:`you<span class="hljs-comment">&#x27;ve been pwned !</span>
my <span class="hljs-keyword">friend</span> needs <span class="hljs-keyword">to</span> know this`}}),Nl=new Z({props:{code:"JTIzJTIwY2F0JTIwcGF5bG9hZC5wa2wlMEFjX19idWlsdGluX18lMEFleGVjJTBBKFZwcmludCglMjJ5b3UndmUlMjBiZWVuJTIwcHduZWQlMjAhJTIyKSUwQXRSJTIwbXklMjBmcmllbmQlMjBuZWVkcyUyMHRvJTIwa25vdyUyMHRoaXMuJTI1JTBBJTBBJTIzJTIwaGV4eWwlMjBwYXlsb2FkLnBrbCUwQSVFMiU5NCU4QyVFMiU5NCU4MCVFMiU5NCU4MCVFMiU5NCU4MCVFMiU5NCU4MCVFMiU5NCU4MCVFMiU5NCU4MCVFMiU5NCU4MCVFMiU5NCU4MCVFMiU5NCVBQyVFMiU5NCU4MCVFMiU5NCU4MCVFMiU5NCU4MCVFMiU5NCU4MCVFMiU5NCU4MCVFMiU5NCU4MCVFMiU5NCU4MCVFMiU5NCU4MCVFMiU5NCU4MCVFMiU5NCU4MCVFMiU5NCU4MCVFMiU5NCU4MCVFMiU5NCU4MCVFMiU5NCU4MCVFMiU5NCU4MCVFMiU5NCU4MCVFMiU5NCU4MCVFMiU5NCU4MCVFMiU5NCU4MCVFMiU5NCU4MCVFMiU5NCU4MCVFMiU5NCU4MCVFMiU5NCU4MCVFMiU5NCU4MCVFMiU5NCU4MCVFMiU5NCVBQyVFMiU5NCU4MCVFMiU5NCU4MCVFMiU5NCU4MCVFMiU5NCU4MCVFMiU5NCU4MCVFMiU5NCU4MCVFMiU5NCU4MCVFMiU5NCU4MCVFMiU5NCU4MCVFMiU5NCU4MCVFMiU5NCU4MCVFMiU5NCU4MCVFMiU5NCU4MCVFMiU5NCU4MCVFMiU5NCU4MCVFMiU5NCU4MCVFMiU5NCU4MCVFMiU5NCU4MCVFMiU5NCU4MCVFMiU5NCU4MCVFMiU5NCU4MCVFMiU5NCU4MCVFMiU5NCU4MCVFMiU5NCU4MCVFMiU5NCU4MCVFMiU5NCVBQyVFMiU5NCU4MCVFMiU5NCU4MCVFMiU5NCU4MCVFMiU5NCU4MCVFMiU5NCU4MCVFMiU5NCU4MCVFMiU5NCU4MCVFMiU5NCU4MCVFMiU5NCVBQyVFMiU5NCU4MCVFMiU5NCU4MCVFMiU5NCU4MCVFMiU5NCU4MCVFMiU5NCU4MCVFMiU5NCU4MCVFMiU5NCU4MCVFMiU5NCU4MCVFMiU5NCU5MCUwQSVFMiU5NCU4MjAwMDAwMDAwJUUyJTk0JTgyJTIwNjMlMjA1ZiUyMDVmJTIwNjIlMjA3NSUyMDY5JTIwNmMlMjA3NCUyMCVFMiU5NCU4QSUyMDY5JTIwNmUlMjA1ZiUyMDVmJTIwMGElMjA2NSUyMDc4JTIwNjUlMjAlRTIlOTQlODJjX19idWlsdCVFMiU5NCU4QWluX19fZXhlJUUyJTk0JTgyJTBBJUUyJTk0JTgyMDAwMDAwMTAlRTIlOTQlODIlMjA2MyUyMDBhJTIwMjglMjA1NiUyMDcwJTIwNzIlMjA2OSUyMDZlJTIwJUUyJTk0JThBJTIwNzQlMjAyOCUyMDIyJTIwNzklMjA2ZiUyMDc1JTIwMjclMjA3NiUyMCVFMiU5NCU4MmNfKFZwcmluJUUyJTk0JThBdCglMjJ5b3UndiVFMiU5NCU4MiUwQSVFMiU5NCU4MjAwMDAwMDIwJUUyJTk0JTgyJTIwNjUlMjAyMCUyMDYyJTIwNjUlMjA2NSUyMDZlJTIwMjAlMjA3MCUyMCVFMiU5NCU4QSUyMDc3JTIwNmUlMjA2NSUyMDY0JTIwMjAlMjAyMSUyMDIyJTIwMjklMjAlRTIlOTQlODJlJTIwYmVlbiUyMHAlRTIlOTQlOEF3bmVkJTIwISUyMiklRTIlOTQlODIlMEElRTIlOTQlODIwMDAwMDAzMCVFMiU5NCU4MiUyMDBhJTIwNzQlMjA1MiUyMDgwJTIwMDQlMjA5NSUyMDIwJTIwMDAlMjAlRTIlOTQlOEElMjAwMCUyMDAwJTIwMDAlMjAwMCUyMDAwJTIwMDAlMjA4YyUyMDFjJTIwJUUyJTk0JTgyX3RSJUMzJTk3JUUyJTgwJUEyJUMzJTk3JTIwMCVFMiU5NCU4QTAwMDAwMCVDMyU5NyVFMiU4MCVBMiVFMiU5NCU4MiUwQSVFMiU5NCU4MjAwMDAwMDQwJUUyJTk0JTgyJTIwNmQlMjA3OSUyMDIwJTIwNjYlMjA3MiUyMDY5JTIwNjUlMjA2ZSUyMCVFMiU5NCU4QSUyMDY0JTIwMjAlMjA2ZSUyMDY1JTIwNjUlMjA2NCUyMDczJTIwMjAlMjAlRTIlOTQlODJteSUyMGZyaWVuJUUyJTk0JThBZCUyMG5lZWRzJTIwJUUyJTk0JTgyJTBBJUUyJTk0JTgyMDAwMDAwNTAlRTIlOTQlODIlMjA3NCUyMDZmJTIwMjAlMjA2YiUyMDZlJTIwNmYlMjA3NyUyMDIwJTIwJUUyJTk0JThBJTIwNzQlMjA2OCUyMDY5JTIwNzMlMjA5NCUyMDJlJTIwJTIwJTIwJTIwJTIwJTIwJTIwJUUyJTk0JTgydG8lMjBrbm93JTIwJUUyJTk0JThBdGhpcyVDMyU5Ny4lMjAlMjAlRTIlOTQlODIlMEElRTIlOTQlOTQlRTIlOTQlODAlRTIlOTQlODAlRTIlOTQlODAlRTIlOTQlODAlRTIlOTQlODAlRTIlOTQlODAlRTIlOTQlODAlRTIlOTQlODAlRTIlOTQlQjQlRTIlOTQlODAlRTIlOTQlODAlRTIlOTQlODAlRTIlOTQlODAlRTIlOTQlODAlRTIlOTQlODAlRTIlOTQlODAlRTIlOTQlODAlRTIlOTQlODAlRTIlOTQlODAlRTIlOTQlODAlRTIlOTQlODAlRTIlOTQlODAlRTIlOTQlODAlRTIlOTQlODAlRTIlOTQlODAlRTIlOTQlODAlRTIlOTQlODAlRTIlOTQlODAlRTIlOTQlODAlRTIlOTQlODAlRTIlOTQlODAlRTIlOTQlODAlRTIlOTQlODAlRTIlOTQlODAlRTIlOTQlQjQlRTIlOTQlODAlRTIlOTQlODAlRTIlOTQlODAlRTIlOTQlODAlRTIlOTQlODAlRTIlOTQlODAlRTIlOTQlODAlRTIlOTQlODAlRTIlOTQlODAlRTIlOTQlODAlRTIlOTQlODAlRTIlOTQlODAlRTIlOTQlODAlRTIlOTQlODAlRTIlOTQlODAlRTIlOTQlODAlRTIlOTQlODAlRTIlOTQlODAlRTIlOTQlODAlRTIlOTQlODAlRTIlOTQlODAlRTIlOTQlODAlRTIlOTQlODAlRTIlOTQlODAlRTIlOTQlODAlRTIlOTQlQjQlRTIlOTQlODAlRTIlOTQlODAlRTIlOTQlODAlRTIlOTQlODAlRTIlOTQlODAlRTIlOTQlODAlRTIlOTQlODAlRTIlOTQlODAlRTIlOTQlQjQlRTIlOTQlODAlRTIlOTQlODAlRTIlOTQlODAlRTIlOTQlODAlRTIlOTQlODAlRTIlOTQlODAlRTIlOTQlODAlRTIlOTQlODAlRTIlOTQlOTg=",highlighted:`<span class="hljs-comment"># cat payload.pkl</span>
c__builtin__
<span class="hljs-built_in">exec</span>
(Vprint(<span class="hljs-string">&quot;you&#x27;ve been pwned !&quot;</span>)
tR my friend needs to know this.%

<span class="hljs-comment"># hexyl payload.pkl</span>
\u250C\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u252C\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u252C\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u252C\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u252C\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2510
\u250200000000\u2502 63 5f 5f 62 75 69 6c 74 \u250A 69 6e 5f 5f 0a 65 78 65 \u2502c__built\u250Ain___exe\u2502
\u250200000010\u2502 63 0a 28 56 70 72 69 6e \u250A 74 28 22 79 6f 75 27 76 \u2502c_(Vprin\u250At(<span class="hljs-string">&quot;you&#x27;v\u2502
\u250200000020\u2502 65 20 62 65 65 6e 20 70 \u250A 77 6e 65 64 20 21 22 29 \u2502e been p\u250Awned !&quot;</span>)\u2502
\u250200000030\u2502 0a 74 52 80 04 95 20 00 \u250A 00 00 00 00 00 00 8c 1c \u2502_tR\xD7\u2022\xD7 0\u250A000000\xD7\u2022\u2502
\u250200000040\u2502 6d 79 20 66 72 69 65 6e \u250A 64 20 6e 65 65 64 73 20 \u2502my frien\u250Ad needs \u2502
\u250200000050\u2502 74 6f 20 6b 6e 6f 77 20 \u250A 74 68 69 73 94 2e       \u2502to know \u250Athis\xD7.  \u2502
\u2514\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2534\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2534\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2534\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2534\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2518`}}),Fl=new Z({props:{code:"JTIzJTIwLi4uJTBBb3Bjb2Rlc19zdGFjayUyMCUzRCUyMCU1QmV4ZWNfZnVuYyUyQyUyMCUyMm1hbGljaW91cyUyMGFyZ3VtZW50JTIyJTJDJTIwJTIyUkVEVUNFJTIyJTVEJTBBb3Bjb2RlJTIwJTNEJTIwc3RhY2sucG9wKCklMEFpZiUyMG9wY29kZSUyMCUzRCUzRCUyMCUyMlJFRFVDRSUyMiUzQSUwQSUyMCUyMCUyMCUyMGFyZyUyMCUzRCUyMG9wY29kZXNfc3RhY2sucG9wKCklMEElMjAlMjAlMjAlMjBjYWxsYWJsZSUyMCUzRCUyMG9wY29kZXNfc3RhY2sucG9wKCklMEElMjAlMjAlMjAlMjBvcGNvZGVzX3N0YWNrLmFwcGVuZChjYWxsYWJsZShhcmcpKSUwQSUyMyUyMC4uLg==",highlighted:`<span class="hljs-comment"># ...</span>
opcodes_stack = [exec_func, <span class="hljs-string">&quot;malicious argument&quot;</span>, <span class="hljs-string">&quot;REDUCE&quot;</span>]
opcode = stack.pop()
<span class="hljs-keyword">if</span> opcode == <span class="hljs-string">&quot;REDUCE&quot;</span>:
    arg = opcodes_stack.pop()
    <span class="hljs-built_in">callable</span> = opcodes_stack.pop()
    opcodes_stack.append(<span class="hljs-built_in">callable</span>(arg))
<span class="hljs-comment"># ...</span>`}}),$l=new O({}),Vl=new O({}),Bl=new O({}),xl=new Z({props:{code:"ZnJvbSUyMHRyYW5zZm9ybWVycyUyMGltcG9ydCUyMEF1dG9Nb2RlbCUwQSUwQW1vZGVsJTIwJTNEJTIwQXV0b01vZGVsLmZyb21fcHJldHJhaW5lZCglMjJiZXJ0LWJhc2UtY2FzZWQlMjIlMkMlMjBmcm9tX2ZsYXglM0RUcnVlKQ==",highlighted:`<span class="hljs-keyword">from</span> transformers <span class="hljs-keyword">import</span> AutoModel

model = AutoModel.from_pretrained(<span class="hljs-string">&quot;bert-base-cased&quot;</span>, from_flax=<span class="hljs-literal">True</span>)`}}),Sl=new O({}),Yl=new O({}),Hl=new O({}),Xl=new O({}),ee=new O({}),oe=new O({}),{c(){j=s("meta"),ws=c(),Q=s("h1"),Y=s("a"),ot=s("span"),T(kl.$$.fragment),Uo=c(),at=s("span"),wo=r("Pickle Scanning"),Ms=c(),Ue=s("p"),Mo=r("Pickle is a widely used serialization format in ML. Most notably, it is the default format for PyTorch model weights."),Js=c(),v=s("p"),Jo=r("There are dangerous arbitrary code execution attacks that can be perpetrated when you load a pickle file. We suggest loading models from users and organizations you trust, relying on signed commits, and/or loading models from TF or Jax formats with the "),rt=s("code"),mo=r("from_tf=True"),ko=r(" auto-conversion mechanism. We also alleviate this issue by displaying/\u201Cvetting\u201D the list of imports in any pickled file, directly on the Hub. Finally, we are experimenting with a new, simple serialization format for weights called "),Ol=s("a"),nt=s("code"),Oo=r("safetensors"),Io=r("."),ds=c(),_=s("h2"),L=s("a"),pt=s("span"),T(Il.$$.fragment),vo=c(),ht=s("span"),Ao=r("What is a pickle?"),ms=c(),H=s("p"),Co=r("From the "),vl=s("a"),Eo=r("official docs"),bo=r(" :"),ks=c(),we=s("blockquote"),Al=s("p"),Do=r("The "),ct=s("code"),go=r("pickle"),jo=r(" module implements binary protocols for serializing and de-serializing a Python object structure."),Os=c(),Me=s("p"),Qo=r("What this means is that pickle is a serializing protocol, something you use to efficiently share data amongst parties."),Is=c(),Je=s("p"),_o=r("We call a pickle the binary file that was generated while pickling."),vs=c(),de=s("p"),Ro=r("At its core, the pickle is basically a stack of instructions or opcodes. As you probably have guessed, it\u2019s not human readable. The opcodes are generated when pickling and read sequentially at unpickling. Based on the opcode, a given action is executed."),As=c(),me=s("p"),No=r("Here\u2019s a small example:"),Cs=c(),T(Cl.$$.fragment),Es=c(),ke=s("p"),Fo=r("When you run this, it will create a pickle file and print the following instructions in your terminal:"),bs=c(),T(El.$$.fragment),Ds=c(),A=s("p"),$o=r("Don\u2019t worry too much about the instructions for now, just know that the "),bl=s("a"),Vo=r("pickletools"),Bo=r(" module is very useful for analyzing pickles. It allows you to read the instructions in the file "),ft=s("strong"),Tt=s("em"),xo=r("without"),So=r(" executing any code."),gs=c(),Oe=s("p"),Po=r("Pickle is not simply a serialization protocol, it allows more flexibility by giving the ability to users to run python code at de-serialization time. Doesn\u2019t sound good, does it?"),js=c(),R=s("h2"),X=s("a"),yt=s("span"),T(Dl.$$.fragment),Go=c(),ut=s("span"),Wo=r("Why is it dangerous?"),Qs=c(),Ie=s("p"),zo=r("As we\u2019ve stated above, de-serializing pickle means that code can be executed. But this comes with certain limitations: you can only reference functions and classes from the top level module; you cannot embed them in the pickle file itself."),_s=c(),ve=s("p"),Zo=r("Back to the drawing board:"),Rs=c(),T(gl.$$.fragment),Ns=c(),q=s("p"),Yo=r("When we run this script we get the "),Ut=s("code"),Lo=r("payload.pkl"),Ho=r(" again. When we check the file\u2019s contents:"),Fs=c(),T(jl.$$.fragment),$s=c(),Ae=s("p"),Xo=r("We can see that there isn\u2019t much in there, a few opcodes and the associated data. You might be thinking, so what\u2019s the problem with pickle?"),Vs=c(),Ce=s("p"),qo=r("Let\u2019s try something else:"),Bs=c(),T(Ql.$$.fragment),xs=c(),C=s("p"),Ko=r("Here we\u2019re using the "),_l=s("a"),la=r("fickling"),ea=r(" library for simplicity. It allows us to add pickle instructions to execute code contained in a string via the "),wt=s("code"),ta=r("exec"),sa=r(" function. This is how you circumvent the fact that you cannot define functions or classes in your pickles: you run exec on python code saved as a string."),Ss=c(),K=s("p"),ia=r("When you run this, it creates a "),Mt=s("code"),oa=r("payload.pkl"),aa=r(" and prints the following:"),Ps=c(),T(Rl.$$.fragment),Gs=c(),Ee=s("p"),ra=r("If we check the contents of the pickle file, we get:"),Ws=c(),T(Nl.$$.fragment),zs=c(),be=s("p"),na=r("Basically, this is what\u2019s happening when you unpickle:"),Zs=c(),T(Fl.$$.fragment),Ys=c(),d=s("p"),pa=r("The instructions that pose a threat are "),Jt=s("code"),ha=r("STACK_GLOBAL"),ca=r(", "),dt=s("code"),fa=r("GLOBAL"),Ta=r(" and "),mt=s("code"),ya=r("REDUCE"),ua=r("."),Ls=c(),I=s("p"),kt=s("code"),Ua=r("REDUCE"),wa=r(" is what tells the unpickler to execute the function with the provided arguments and "),Ot=s("code"),Ma=r("*GLOBAL"),Ja=r(" instructions are telling the unpickler to "),It=s("code"),da=r("import"),ma=r(" stuff."),Hs=c(),De=s("p"),ka=r("To sum up, pickle is dangerous because:"),Xs=c(),E=s("ul"),vt=s("li"),Oa=r("when importing a python module, arbitrary code can be executed"),Ia=c(),N=s("li"),va=r("you can import builtin functions like "),At=s("code"),Aa=r("eval"),Ca=r(" or "),Ct=s("code"),Ea=r("exec"),ba=r(", which can be used to execute arbitrary code"),Da=c(),Et=s("li"),ga=r("when instantiating an object, the constructor may be called"),qs=c(),ge=s("p"),ja=r("This is why it is stated in most docs using pickle, do not unpickle data from untrusted sources."),Ks=c(),F=s("h2"),ll=s("a"),bt=s("span"),T($l.$$.fragment),Qa=c(),Dt=s("span"),_a=r("Mitigation Strategies"),li=c(),je=s("p"),gt=s("strong"),jt=s("em"),Ra=r("Don\u2019t use pickle"),ei=c(),Qe=s("p"),Na=r("Sound advice Luc, but pickle is used profusely and isn\u2019t going anywhere soon: finding a new format everyone is happy with and initiating the change will take some time."),ti=c(),_e=s("p"),Fa=r("So what can we do for now?"),si=c(),$=s("h3"),el=s("a"),Qt=s("span"),T(Vl.$$.fragment),$a=c(),_t=s("span"),Va=r("Load files from users and organizations you trust"),ii=c(),b=s("p"),Ba=r("On the Hub, you have the ability to "),Re=s("a"),xa=r("sign your commits with a GPG key"),Sa=r(". This does "),Rt=s("strong"),Pa=r("not"),Ga=r(" guarantee that your file is safe, but it does guarantee the origin of the file."),oi=c(),Ne=s("p"),Wa=r("If you know and trust user A and the commit that includes the file on the Hub is signed by user A\u2019s GPG key, it\u2019s pretty safe to assume that you can trust the file."),ai=c(),V=s("h3"),tl=s("a"),Nt=s("span"),T(Bl.$$.fragment),za=c(),Ft=s("span"),Za=r("Load model weights from TF or Flax"),ri=c(),m=s("p"),Ya=r("TensorFlow and Flax checkpoints are not affected, and can be loaded within PyTorch architectures using the "),$t=s("code"),La=r("from_tf"),Ha=r(" and "),Vt=s("code"),Xa=r("from_flax"),qa=r(" kwargs for the "),Bt=s("code"),Ka=r("from_pretrained"),lr=r(" method to circumvent this issue."),ni=c(),Fe=s("p"),er=r("E.g.:"),pi=c(),T(xl.$$.fragment),hi=c(),B=s("h3"),sl=s("a"),xt=s("span"),T(Sl.$$.fragment),tr=c(),St=s("span"),sr=r("Use your own serialization format"),ci=c(),J=s("ul"),Pt=s("li"),Pl=s("a"),ir=r("MsgPack"),or=c(),Gt=s("li"),Gl=s("a"),ar=r("Protobuf"),rr=c(),Wt=s("li"),Wl=s("a"),nr=r("Cap\u2019n\u2019proto"),pr=c(),zt=s("li"),zl=s("a"),hr=r("Avro"),cr=c(),Zt=s("li"),Zl=s("a"),fr=r("safetensors"),fi=c(),il=s("p"),Tr=r("This last format, "),Yt=s("code"),yr=r("safetensors"),ur=r(", is a simple serialization format that we are working on and experimenting with currently! Please help or contribute if you can \u{1F525}."),Ti=c(),x=s("h3"),ol=s("a"),Lt=s("span"),T(Yl.$$.fragment),Ur=c(),$e=s("span"),wr=r("Improve "),Ht=s("code"),Mr=r("torch.load/save"),yi=c(),al=s("p"),Jr=r("There\u2019s an open discussion in progress at PyTorch on having a "),Ll=s("a"),dr=r("Safe way of loading only weights from *.pt file by default"),mr=r(" \u2013 please chime in there!"),ui=c(),S=s("h3"),rl=s("a"),Xt=s("span"),T(Hl.$$.fragment),kr=c(),qt=s("span"),Or=r("Hub\u2019s Security Scanner"),Ui=c(),P=s("h4"),nl=s("a"),Kt=s("span"),T(Xl.$$.fragment),Ir=c(),ls=s("span"),vr=r("What we have now"),wi=c(),Ve=s("p"),Ar=r("We have created a security scanner that scans every file pushed to the Hub and runs security checks. At the time of writing, it runs two types of scans:"),Mi=c(),pl=s("ul"),es=s("li"),Cr=r("ClamAV scans"),Er=c(),ts=s("li"),br=r("Pickle Import scans"),Ji=c(),hl=s("p"),Dr=r("For ClamAV scans, files are run through the open-source antivirus "),ql=s("a"),gr=r("ClamAV"),jr=r(". While this covers a good amount of dangerous files, it doesn\u2019t cover pickle exploits."),di=c(),cl=s("p"),Qr=r("We have implemented a Pickle Import scan, which extracts the list of imports referenced in a pickle file. Every time you upload a "),ss=s("code"),_r=r("pytorch_model.bin"),Rr=r(" or any other pickled file, this scan is run."),mi=c(),Be=s("p"),Nr=r("On the hub the list of imports will be displayed next to each file containing imports. If any import looks suspicious, it will be highlighted."),ki=c(),G=s("div"),xe=s("img"),Fr=c(),Se=s("img"),Oi=c(),fl=s("p"),$r=r("We get this data thanks to "),Kl=s("a"),is=s("code"),Vr=r("pickletools.genops"),Br=r(" which allows us to read the file without executing potentially dangerous code."),Ii=c(),D=s("p"),xr=r("Note that this is what allows to know if, when unpickling a file, it will "),os=s("code"),Sr=r("REDUCE"),Pr=r(" on a potentially dangerous function that was imported by "),as=s("code"),Gr=r("*GLOBAL"),Wr=r("."),vi=c(),le=s("p"),rs=s("strong"),ns=s("em"),zr=r("Disclaimer"),Zr=r(`: this is not 100% foolproof. It is your responsibility as a user to check if something is safe or not. We are not actively auditing python packages for safety, the safe/unsafe imports lists we have are maintained in a best-effort manner.
Please contact us if you think something is not safe, and we flag it as such, by sending us an email to website at huggingface.co`),Ai=c(),W=s("h4"),Tl=s("a"),ps=s("span"),T(ee.$$.fragment),Yr=c(),hs=s("span"),Lr=r("Potential solutions"),Ci=c(),k=s("p"),Hr=r("One could think of creating a custom "),te=s("a"),Xr=r("Unpickler"),qr=r(" in the likes of "),se=s("a"),Kr=r("this one"),ln=r(". But as we can see in this "),ie=s("a"),en=r("sophisticated exploit"),tn=r(", this won\u2019t work."),Ei=c(),yl=s("p"),sn=r("Thankfully, there is always a trace of the "),cs=s("code"),on=r("eval"),an=r(" import, so reading the opcodes directly should allow to catch malicious usage."),bi=c(),ul=s("p"),rn=r("The current solution I propose is creating a file resembling a "),fs=s("code"),nn=r(".gitignore"),pn=r(" but for imports."),Di=c(),Ul=s("p"),hn=r("This file would be a whitelist of imports that would make a "),Ts=s("code"),cn=r("pytorch_model.bin"),fn=r(" file flagged as dangerous if there are imports not included in the whitelist."),gi=c(),wl=s("p"),Tn=r("One could imagine having a regex-ish format where you could allow all numpy submodules for instance via a simple line like: "),ys=s("code"),yn=r("numpy.*"),un=r("."),ji=c(),z=s("h2"),Ml=s("a"),us=s("span"),T(oe.$$.fragment),Un=c(),Us=s("span"),wn=r("Further Reading"),Qi=c(),Pe=s("p"),ae=s("a"),Mn=r("pickle - Python object serialization - Python 3.10.6 documentation"),_i=c(),Ge=s("p"),re=s("a"),Jn=r("Dangerous Pickles - Malicious Python Serialization"),Ri=c(),We=s("p"),ne=s("a"),dn=r("GitHub - trailofbits/fickling: A Python pickling decompiler and static analyzer"),Ni=c(),ze=s("p"),pe=s("a"),mn=r("Exploiting Python pickles"),Fi=c(),Ze=s("p"),he=s("a"),kn=r("cpython/pickletools.py at 3.10 \xB7 python/cpython"),$i=c(),Ye=s("p"),ce=s("a"),On=r("cpython/pickle.py at 3.10 \xB7 python/cpython"),Vi=c(),Le=s("p"),fe=s("a"),In=r("CrypTen/serial.py at main \xB7 facebookresearch/CrypTen"),Bi=c(),He=s("p"),Te=s("a"),vn=r("CTFtime.org / Balsn CTF 2019 / pyshv1 / Writeup"),xi=c(),Xe=s("p"),ye=s("a"),An=r("Rehabilitating Python\u2019s pickle module"),this.h()},l(l){const a=pc('[data-svelte="svelte-1phssyn"]',document.head);j=i(a,"META",{name:!0,content:!0}),a.forEach(e),ws=f(l),Q=i(l,"H1",{class:!0});var Pi=o(Q);Y=i(Pi,"A",{id:!0,class:!0,href:!0});var jn=o(Y);ot=i(jn,"SPAN",{});var Qn=o(ot);y(kl.$$.fragment,Qn),Qn.forEach(e),jn.forEach(e),Uo=f(Pi),at=i(Pi,"SPAN",{});var _n=o(at);wo=n(_n,"Pickle Scanning"),_n.forEach(e),Pi.forEach(e),Ms=f(l),Ue=i(l,"P",{});var Rn=o(Ue);Mo=n(Rn,"Pickle is a widely used serialization format in ML. Most notably, it is the default format for PyTorch model weights."),Rn.forEach(e),Js=f(l),v=i(l,"P",{});var qe=o(v);Jo=n(qe,"There are dangerous arbitrary code execution attacks that can be perpetrated when you load a pickle file. We suggest loading models from users and organizations you trust, relying on signed commits, and/or loading models from TF or Jax formats with the "),rt=i(qe,"CODE",{});var Nn=o(rt);mo=n(Nn,"from_tf=True"),Nn.forEach(e),ko=n(qe," auto-conversion mechanism. We also alleviate this issue by displaying/\u201Cvetting\u201D the list of imports in any pickled file, directly on the Hub. Finally, we are experimenting with a new, simple serialization format for weights called "),Ol=i(qe,"A",{href:!0,rel:!0});var Fn=o(Ol);nt=i(Fn,"CODE",{});var $n=o(nt);Oo=n($n,"safetensors"),$n.forEach(e),Fn.forEach(e),Io=n(qe,"."),qe.forEach(e),ds=f(l),_=i(l,"H2",{class:!0});var Gi=o(_);L=i(Gi,"A",{id:!0,class:!0,href:!0});var Vn=o(L);pt=i(Vn,"SPAN",{});var Bn=o(pt);y(Il.$$.fragment,Bn),Bn.forEach(e),Vn.forEach(e),vo=f(Gi),ht=i(Gi,"SPAN",{});var xn=o(ht);Ao=n(xn,"What is a pickle?"),xn.forEach(e),Gi.forEach(e),ms=f(l),H=i(l,"P",{});var Wi=o(H);Co=n(Wi,"From the "),vl=i(Wi,"A",{href:!0,rel:!0});var Sn=o(vl);Eo=n(Sn,"official docs"),Sn.forEach(e),bo=n(Wi," :"),Wi.forEach(e),ks=f(l),we=i(l,"BLOCKQUOTE",{});var Pn=o(we);Al=i(Pn,"P",{});var zi=o(Al);Do=n(zi,"The "),ct=i(zi,"CODE",{});var Gn=o(ct);go=n(Gn,"pickle"),Gn.forEach(e),jo=n(zi," module implements binary protocols for serializing and de-serializing a Python object structure."),zi.forEach(e),Pn.forEach(e),Os=f(l),Me=i(l,"P",{});var Wn=o(Me);Qo=n(Wn,"What this means is that pickle is a serializing protocol, something you use to efficiently share data amongst parties."),Wn.forEach(e),Is=f(l),Je=i(l,"P",{});var zn=o(Je);_o=n(zn,"We call a pickle the binary file that was generated while pickling."),zn.forEach(e),vs=f(l),de=i(l,"P",{});var Zn=o(de);Ro=n(Zn,"At its core, the pickle is basically a stack of instructions or opcodes. As you probably have guessed, it\u2019s not human readable. The opcodes are generated when pickling and read sequentially at unpickling. Based on the opcode, a given action is executed."),Zn.forEach(e),As=f(l),me=i(l,"P",{});var Yn=o(me);No=n(Yn,"Here\u2019s a small example:"),Yn.forEach(e),Cs=f(l),y(Cl.$$.fragment,l),Es=f(l),ke=i(l,"P",{});var Ln=o(ke);Fo=n(Ln,"When you run this, it will create a pickle file and print the following instructions in your terminal:"),Ln.forEach(e),bs=f(l),y(El.$$.fragment,l),Ds=f(l),A=i(l,"P",{});var Ke=o(A);$o=n(Ke,"Don\u2019t worry too much about the instructions for now, just know that the "),bl=i(Ke,"A",{href:!0,rel:!0});var Hn=o(bl);Vo=n(Hn,"pickletools"),Hn.forEach(e),Bo=n(Ke," module is very useful for analyzing pickles. It allows you to read the instructions in the file "),ft=i(Ke,"STRONG",{});var Xn=o(ft);Tt=i(Xn,"EM",{});var qn=o(Tt);xo=n(qn,"without"),qn.forEach(e),Xn.forEach(e),So=n(Ke," executing any code."),Ke.forEach(e),gs=f(l),Oe=i(l,"P",{});var Kn=o(Oe);Po=n(Kn,"Pickle is not simply a serialization protocol, it allows more flexibility by giving the ability to users to run python code at de-serialization time. Doesn\u2019t sound good, does it?"),Kn.forEach(e),js=f(l),R=i(l,"H2",{class:!0});var Zi=o(R);X=i(Zi,"A",{id:!0,class:!0,href:!0});var lp=o(X);yt=i(lp,"SPAN",{});var ep=o(yt);y(Dl.$$.fragment,ep),ep.forEach(e),lp.forEach(e),Go=f(Zi),ut=i(Zi,"SPAN",{});var tp=o(ut);Wo=n(tp,"Why is it dangerous?"),tp.forEach(e),Zi.forEach(e),Qs=f(l),Ie=i(l,"P",{});var sp=o(Ie);zo=n(sp,"As we\u2019ve stated above, de-serializing pickle means that code can be executed. But this comes with certain limitations: you can only reference functions and classes from the top level module; you cannot embed them in the pickle file itself."),sp.forEach(e),_s=f(l),ve=i(l,"P",{});var ip=o(ve);Zo=n(ip,"Back to the drawing board:"),ip.forEach(e),Rs=f(l),y(gl.$$.fragment,l),Ns=f(l),q=i(l,"P",{});var Yi=o(q);Yo=n(Yi,"When we run this script we get the "),Ut=i(Yi,"CODE",{});var op=o(Ut);Lo=n(op,"payload.pkl"),op.forEach(e),Ho=n(Yi," again. When we check the file\u2019s contents:"),Yi.forEach(e),Fs=f(l),y(jl.$$.fragment,l),$s=f(l),Ae=i(l,"P",{});var ap=o(Ae);Xo=n(ap,"We can see that there isn\u2019t much in there, a few opcodes and the associated data. You might be thinking, so what\u2019s the problem with pickle?"),ap.forEach(e),Vs=f(l),Ce=i(l,"P",{});var rp=o(Ce);qo=n(rp,"Let\u2019s try something else:"),rp.forEach(e),Bs=f(l),y(Ql.$$.fragment,l),xs=f(l),C=i(l,"P",{});var lt=o(C);Ko=n(lt,"Here we\u2019re using the "),_l=i(lt,"A",{href:!0,rel:!0});var np=o(_l);la=n(np,"fickling"),np.forEach(e),ea=n(lt," library for simplicity. It allows us to add pickle instructions to execute code contained in a string via the "),wt=i(lt,"CODE",{});var pp=o(wt);ta=n(pp,"exec"),pp.forEach(e),sa=n(lt," function. This is how you circumvent the fact that you cannot define functions or classes in your pickles: you run exec on python code saved as a string."),lt.forEach(e),Ss=f(l),K=i(l,"P",{});var Li=o(K);ia=n(Li,"When you run this, it creates a "),Mt=i(Li,"CODE",{});var hp=o(Mt);oa=n(hp,"payload.pkl"),hp.forEach(e),aa=n(Li," and prints the following:"),Li.forEach(e),Ps=f(l),y(Rl.$$.fragment,l),Gs=f(l),Ee=i(l,"P",{});var cp=o(Ee);ra=n(cp,"If we check the contents of the pickle file, we get:"),cp.forEach(e),Ws=f(l),y(Nl.$$.fragment,l),zs=f(l),be=i(l,"P",{});var fp=o(be);na=n(fp,"Basically, this is what\u2019s happening when you unpickle:"),fp.forEach(e),Zs=f(l),y(Fl.$$.fragment,l),Ys=f(l),d=i(l,"P",{});var Jl=o(d);pa=n(Jl,"The instructions that pose a threat are "),Jt=i(Jl,"CODE",{});var Tp=o(Jt);ha=n(Tp,"STACK_GLOBAL"),Tp.forEach(e),ca=n(Jl,", "),dt=i(Jl,"CODE",{});var yp=o(dt);fa=n(yp,"GLOBAL"),yp.forEach(e),Ta=n(Jl," and "),mt=i(Jl,"CODE",{});var up=o(mt);ya=n(up,"REDUCE"),up.forEach(e),ua=n(Jl,"."),Jl.forEach(e),Ls=f(l),I=i(l,"P",{});var ue=o(I);kt=i(ue,"CODE",{});var Up=o(kt);Ua=n(Up,"REDUCE"),Up.forEach(e),wa=n(ue," is what tells the unpickler to execute the function with the provided arguments and "),Ot=i(ue,"CODE",{});var wp=o(Ot);Ma=n(wp,"*GLOBAL"),wp.forEach(e),Ja=n(ue," instructions are telling the unpickler to "),It=i(ue,"CODE",{});var Mp=o(It);da=n(Mp,"import"),Mp.forEach(e),ma=n(ue," stuff."),ue.forEach(e),Hs=f(l),De=i(l,"P",{});var Jp=o(De);ka=n(Jp,"To sum up, pickle is dangerous because:"),Jp.forEach(e),Xs=f(l),E=i(l,"UL",{});var et=o(E);vt=i(et,"LI",{});var dp=o(vt);Oa=n(dp,"when importing a python module, arbitrary code can be executed"),dp.forEach(e),Ia=f(et),N=i(et,"LI",{});var tt=o(N);va=n(tt,"you can import builtin functions like "),At=i(tt,"CODE",{});var mp=o(At);Aa=n(mp,"eval"),mp.forEach(e),Ca=n(tt," or "),Ct=i(tt,"CODE",{});var kp=o(Ct);Ea=n(kp,"exec"),kp.forEach(e),ba=n(tt,", which can be used to execute arbitrary code"),tt.forEach(e),Da=f(et),Et=i(et,"LI",{});var Op=o(Et);ga=n(Op,"when instantiating an object, the constructor may be called"),Op.forEach(e),et.forEach(e),qs=f(l),ge=i(l,"P",{});var Ip=o(ge);ja=n(Ip,"This is why it is stated in most docs using pickle, do not unpickle data from untrusted sources."),Ip.forEach(e),Ks=f(l),F=i(l,"H2",{class:!0});var Hi=o(F);ll=i(Hi,"A",{id:!0,class:!0,href:!0});var vp=o(ll);bt=i(vp,"SPAN",{});var Ap=o(bt);y($l.$$.fragment,Ap),Ap.forEach(e),vp.forEach(e),Qa=f(Hi),Dt=i(Hi,"SPAN",{});var Cp=o(Dt);_a=n(Cp,"Mitigation Strategies"),Cp.forEach(e),Hi.forEach(e),li=f(l),je=i(l,"P",{});var Ep=o(je);gt=i(Ep,"STRONG",{});var bp=o(gt);jt=i(bp,"EM",{});var Dp=o(jt);Ra=n(Dp,"Don\u2019t use pickle"),Dp.forEach(e),bp.forEach(e),Ep.forEach(e),ei=f(l),Qe=i(l,"P",{});var gp=o(Qe);Na=n(gp,"Sound advice Luc, but pickle is used profusely and isn\u2019t going anywhere soon: finding a new format everyone is happy with and initiating the change will take some time."),gp.forEach(e),ti=f(l),_e=i(l,"P",{});var jp=o(_e);Fa=n(jp,"So what can we do for now?"),jp.forEach(e),si=f(l),$=i(l,"H3",{class:!0});var Xi=o($);el=i(Xi,"A",{id:!0,class:!0,href:!0});var Qp=o(el);Qt=i(Qp,"SPAN",{});var _p=o(Qt);y(Vl.$$.fragment,_p),_p.forEach(e),Qp.forEach(e),$a=f(Xi),_t=i(Xi,"SPAN",{});var Rp=o(_t);Va=n(Rp,"Load files from users and organizations you trust"),Rp.forEach(e),Xi.forEach(e),ii=f(l),b=i(l,"P",{});var st=o(b);Ba=n(st,"On the Hub, you have the ability to "),Re=i(st,"A",{href:!0});var Np=o(Re);xa=n(Np,"sign your commits with a GPG key"),Np.forEach(e),Sa=n(st,". This does "),Rt=i(st,"STRONG",{});var Fp=o(Rt);Pa=n(Fp,"not"),Fp.forEach(e),Ga=n(st," guarantee that your file is safe, but it does guarantee the origin of the file."),st.forEach(e),oi=f(l),Ne=i(l,"P",{});var $p=o(Ne);Wa=n($p,"If you know and trust user A and the commit that includes the file on the Hub is signed by user A\u2019s GPG key, it\u2019s pretty safe to assume that you can trust the file."),$p.forEach(e),ai=f(l),V=i(l,"H3",{class:!0});var qi=o(V);tl=i(qi,"A",{id:!0,class:!0,href:!0});var Vp=o(tl);Nt=i(Vp,"SPAN",{});var Bp=o(Nt);y(Bl.$$.fragment,Bp),Bp.forEach(e),Vp.forEach(e),za=f(qi),Ft=i(qi,"SPAN",{});var xp=o(Ft);Za=n(xp,"Load model weights from TF or Flax"),xp.forEach(e),qi.forEach(e),ri=f(l),m=i(l,"P",{});var dl=o(m);Ya=n(dl,"TensorFlow and Flax checkpoints are not affected, and can be loaded within PyTorch architectures using the "),$t=i(dl,"CODE",{});var Sp=o($t);La=n(Sp,"from_tf"),Sp.forEach(e),Ha=n(dl," and "),Vt=i(dl,"CODE",{});var Pp=o(Vt);Xa=n(Pp,"from_flax"),Pp.forEach(e),qa=n(dl," kwargs for the "),Bt=i(dl,"CODE",{});var Gp=o(Bt);Ka=n(Gp,"from_pretrained"),Gp.forEach(e),lr=n(dl," method to circumvent this issue."),dl.forEach(e),ni=f(l),Fe=i(l,"P",{});var Wp=o(Fe);er=n(Wp,"E.g.:"),Wp.forEach(e),pi=f(l),y(xl.$$.fragment,l),hi=f(l),B=i(l,"H3",{class:!0});var Ki=o(B);sl=i(Ki,"A",{id:!0,class:!0,href:!0});var zp=o(sl);xt=i(zp,"SPAN",{});var Zp=o(xt);y(Sl.$$.fragment,Zp),Zp.forEach(e),zp.forEach(e),tr=f(Ki),St=i(Ki,"SPAN",{});var Yp=o(St);sr=n(Yp,"Use your own serialization format"),Yp.forEach(e),Ki.forEach(e),ci=f(l),J=i(l,"UL",{});var g=o(J);Pt=i(g,"LI",{});var Lp=o(Pt);Pl=i(Lp,"A",{href:!0,rel:!0});var Hp=o(Pl);ir=n(Hp,"MsgPack"),Hp.forEach(e),Lp.forEach(e),or=f(g),Gt=i(g,"LI",{});var Xp=o(Gt);Gl=i(Xp,"A",{href:!0,rel:!0});var qp=o(Gl);ar=n(qp,"Protobuf"),qp.forEach(e),Xp.forEach(e),rr=f(g),Wt=i(g,"LI",{});var Kp=o(Wt);Wl=i(Kp,"A",{href:!0,rel:!0});var lh=o(Wl);nr=n(lh,"Cap\u2019n\u2019proto"),lh.forEach(e),Kp.forEach(e),pr=f(g),zt=i(g,"LI",{});var eh=o(zt);zl=i(eh,"A",{href:!0,rel:!0});var th=o(zl);hr=n(th,"Avro"),th.forEach(e),eh.forEach(e),cr=f(g),Zt=i(g,"LI",{});var sh=o(Zt);Zl=i(sh,"A",{href:!0,rel:!0});var ih=o(Zl);fr=n(ih,"safetensors"),ih.forEach(e),sh.forEach(e),g.forEach(e),fi=f(l),il=i(l,"P",{});var lo=o(il);Tr=n(lo,"This last format, "),Yt=i(lo,"CODE",{});var oh=o(Yt);yr=n(oh,"safetensors"),oh.forEach(e),ur=n(lo,", is a simple serialization format that we are working on and experimenting with currently! Please help or contribute if you can \u{1F525}."),lo.forEach(e),Ti=f(l),x=i(l,"H3",{class:!0});var eo=o(x);ol=i(eo,"A",{id:!0,class:!0,href:!0});var ah=o(ol);Lt=i(ah,"SPAN",{});var rh=o(Lt);y(Yl.$$.fragment,rh),rh.forEach(e),ah.forEach(e),Ur=f(eo),$e=i(eo,"SPAN",{});var Cn=o($e);wr=n(Cn,"Improve "),Ht=i(Cn,"CODE",{});var nh=o(Ht);Mr=n(nh,"torch.load/save"),nh.forEach(e),Cn.forEach(e),eo.forEach(e),yi=f(l),al=i(l,"P",{});var to=o(al);Jr=n(to,"There\u2019s an open discussion in progress at PyTorch on having a "),Ll=i(to,"A",{href:!0,rel:!0});var ph=o(Ll);dr=n(ph,"Safe way of loading only weights from *.pt file by default"),ph.forEach(e),mr=n(to," \u2013 please chime in there!"),to.forEach(e),ui=f(l),S=i(l,"H3",{class:!0});var so=o(S);rl=i(so,"A",{id:!0,class:!0,href:!0});var hh=o(rl);Xt=i(hh,"SPAN",{});var ch=o(Xt);y(Hl.$$.fragment,ch),ch.forEach(e),hh.forEach(e),kr=f(so),qt=i(so,"SPAN",{});var fh=o(qt);Or=n(fh,"Hub\u2019s Security Scanner"),fh.forEach(e),so.forEach(e),Ui=f(l),P=i(l,"H4",{class:!0});var io=o(P);nl=i(io,"A",{id:!0,class:!0,href:!0});var Th=o(nl);Kt=i(Th,"SPAN",{});var yh=o(Kt);y(Xl.$$.fragment,yh),yh.forEach(e),Th.forEach(e),Ir=f(io),ls=i(io,"SPAN",{});var uh=o(ls);vr=n(uh,"What we have now"),uh.forEach(e),io.forEach(e),wi=f(l),Ve=i(l,"P",{});var Uh=o(Ve);Ar=n(Uh,"We have created a security scanner that scans every file pushed to the Hub and runs security checks. At the time of writing, it runs two types of scans:"),Uh.forEach(e),Mi=f(l),pl=i(l,"UL",{});var oo=o(pl);es=i(oo,"LI",{});var wh=o(es);Cr=n(wh,"ClamAV scans"),wh.forEach(e),Er=f(oo),ts=i(oo,"LI",{});var Mh=o(ts);br=n(Mh,"Pickle Import scans"),Mh.forEach(e),oo.forEach(e),Ji=f(l),hl=i(l,"P",{});var ao=o(hl);Dr=n(ao,"For ClamAV scans, files are run through the open-source antivirus "),ql=i(ao,"A",{href:!0,rel:!0});var Jh=o(ql);gr=n(Jh,"ClamAV"),Jh.forEach(e),jr=n(ao,". While this covers a good amount of dangerous files, it doesn\u2019t cover pickle exploits."),ao.forEach(e),di=f(l),cl=i(l,"P",{});var ro=o(cl);Qr=n(ro,"We have implemented a Pickle Import scan, which extracts the list of imports referenced in a pickle file. Every time you upload a "),ss=i(ro,"CODE",{});var dh=o(ss);_r=n(dh,"pytorch_model.bin"),dh.forEach(e),Rr=n(ro," or any other pickled file, this scan is run."),ro.forEach(e),mi=f(l),Be=i(l,"P",{});var mh=o(Be);Nr=n(mh,"On the hub the list of imports will be displayed next to each file containing imports. If any import looks suspicious, it will be highlighted."),mh.forEach(e),ki=f(l),G=i(l,"DIV",{class:!0});var no=o(G);xe=i(no,"IMG",{class:!0,src:!0}),Fr=f(no),Se=i(no,"IMG",{class:!0,src:!0}),no.forEach(e),Oi=f(l),fl=i(l,"P",{});var po=o(fl);$r=n(po,"We get this data thanks to "),Kl=i(po,"A",{href:!0,rel:!0});var kh=o(Kl);is=i(kh,"CODE",{});var Oh=o(is);Vr=n(Oh,"pickletools.genops"),Oh.forEach(e),kh.forEach(e),Br=n(po," which allows us to read the file without executing potentially dangerous code."),po.forEach(e),Ii=f(l),D=i(l,"P",{});var it=o(D);xr=n(it,"Note that this is what allows to know if, when unpickling a file, it will "),os=i(it,"CODE",{});var Ih=o(os);Sr=n(Ih,"REDUCE"),Ih.forEach(e),Pr=n(it," on a potentially dangerous function that was imported by "),as=i(it,"CODE",{});var vh=o(as);Gr=n(vh,"*GLOBAL"),vh.forEach(e),Wr=n(it,"."),it.forEach(e),vi=f(l),le=i(l,"P",{});var En=o(le);rs=i(En,"STRONG",{});var Ah=o(rs);ns=i(Ah,"EM",{});var Ch=o(ns);zr=n(Ch,"Disclaimer"),Ch.forEach(e),Ah.forEach(e),Zr=n(En,`: this is not 100% foolproof. It is your responsibility as a user to check if something is safe or not. We are not actively auditing python packages for safety, the safe/unsafe imports lists we have are maintained in a best-effort manner.
Please contact us if you think something is not safe, and we flag it as such, by sending us an email to website at huggingface.co`),En.forEach(e),Ai=f(l),W=i(l,"H4",{class:!0});var ho=o(W);Tl=i(ho,"A",{id:!0,class:!0,href:!0});var Eh=o(Tl);ps=i(Eh,"SPAN",{});var bh=o(ps);y(ee.$$.fragment,bh),bh.forEach(e),Eh.forEach(e),Yr=f(ho),hs=i(ho,"SPAN",{});var Dh=o(hs);Lr=n(Dh,"Potential solutions"),Dh.forEach(e),ho.forEach(e),Ci=f(l),k=i(l,"P",{});var ml=o(k);Hr=n(ml,"One could think of creating a custom "),te=i(ml,"A",{href:!0,rel:!0});var gh=o(te);Xr=n(gh,"Unpickler"),gh.forEach(e),qr=n(ml," in the likes of "),se=i(ml,"A",{href:!0,rel:!0});var jh=o(se);Kr=n(jh,"this one"),jh.forEach(e),ln=n(ml,". But as we can see in this "),ie=i(ml,"A",{href:!0,rel:!0});var Qh=o(ie);en=n(Qh,"sophisticated exploit"),Qh.forEach(e),tn=n(ml,", this won\u2019t work."),ml.forEach(e),Ei=f(l),yl=i(l,"P",{});var co=o(yl);sn=n(co,"Thankfully, there is always a trace of the "),cs=i(co,"CODE",{});var _h=o(cs);on=n(_h,"eval"),_h.forEach(e),an=n(co," import, so reading the opcodes directly should allow to catch malicious usage."),co.forEach(e),bi=f(l),ul=i(l,"P",{});var fo=o(ul);rn=n(fo,"The current solution I propose is creating a file resembling a "),fs=i(fo,"CODE",{});var Rh=o(fs);nn=n(Rh,".gitignore"),Rh.forEach(e),pn=n(fo," but for imports."),fo.forEach(e),Di=f(l),Ul=i(l,"P",{});var To=o(Ul);hn=n(To,"This file would be a whitelist of imports that would make a "),Ts=i(To,"CODE",{});var Nh=o(Ts);cn=n(Nh,"pytorch_model.bin"),Nh.forEach(e),fn=n(To," file flagged as dangerous if there are imports not included in the whitelist."),To.forEach(e),gi=f(l),wl=i(l,"P",{});var yo=o(wl);Tn=n(yo,"One could imagine having a regex-ish format where you could allow all numpy submodules for instance via a simple line like: "),ys=i(yo,"CODE",{});var Fh=o(ys);yn=n(Fh,"numpy.*"),Fh.forEach(e),un=n(yo,"."),yo.forEach(e),ji=f(l),z=i(l,"H2",{class:!0});var uo=o(z);Ml=i(uo,"A",{id:!0,class:!0,href:!0});var $h=o(Ml);us=i($h,"SPAN",{});var Vh=o(us);y(oe.$$.fragment,Vh),Vh.forEach(e),$h.forEach(e),Un=f(uo),Us=i(uo,"SPAN",{});var Bh=o(Us);wn=n(Bh,"Further Reading"),Bh.forEach(e),uo.forEach(e),Qi=f(l),Pe=i(l,"P",{});var xh=o(Pe);ae=i(xh,"A",{href:!0,rel:!0});var Sh=o(ae);Mn=n(Sh,"pickle - Python object serialization - Python 3.10.6 documentation"),Sh.forEach(e),xh.forEach(e),_i=f(l),Ge=i(l,"P",{});var Ph=o(Ge);re=i(Ph,"A",{href:!0,rel:!0});var Gh=o(re);Jn=n(Gh,"Dangerous Pickles - Malicious Python Serialization"),Gh.forEach(e),Ph.forEach(e),Ri=f(l),We=i(l,"P",{});var Wh=o(We);ne=i(Wh,"A",{href:!0,rel:!0});var zh=o(ne);dn=n(zh,"GitHub - trailofbits/fickling: A Python pickling decompiler and static analyzer"),zh.forEach(e),Wh.forEach(e),Ni=f(l),ze=i(l,"P",{});var Zh=o(ze);pe=i(Zh,"A",{href:!0,rel:!0});var Yh=o(pe);mn=n(Yh,"Exploiting Python pickles"),Yh.forEach(e),Zh.forEach(e),Fi=f(l),Ze=i(l,"P",{});var Lh=o(Ze);he=i(Lh,"A",{href:!0,rel:!0});var Hh=o(he);kn=n(Hh,"cpython/pickletools.py at 3.10 \xB7 python/cpython"),Hh.forEach(e),Lh.forEach(e),$i=f(l),Ye=i(l,"P",{});var Xh=o(Ye);ce=i(Xh,"A",{href:!0,rel:!0});var qh=o(ce);On=n(qh,"cpython/pickle.py at 3.10 \xB7 python/cpython"),qh.forEach(e),Xh.forEach(e),Vi=f(l),Le=i(l,"P",{});var Kh=o(Le);fe=i(Kh,"A",{href:!0,rel:!0});var lc=o(fe);In=n(lc,"CrypTen/serial.py at main \xB7 facebookresearch/CrypTen"),lc.forEach(e),Kh.forEach(e),Bi=f(l),He=i(l,"P",{});var ec=o(He);Te=i(ec,"A",{href:!0,rel:!0});var tc=o(Te);vn=n(tc,"CTFtime.org / Balsn CTF 2019 / pyshv1 / Writeup"),tc.forEach(e),ec.forEach(e),xi=f(l),Xe=i(l,"P",{});var sc=o(Xe);ye=i(sc,"A",{href:!0,rel:!0});var ic=o(ye);An=n(ic,"Rehabilitating Python\u2019s pickle module"),ic.forEach(e),sc.forEach(e),this.h()},h(){h(j,"name","hf:doc:metadata"),h(j,"content",JSON.stringify(Tc)),h(Y,"id","pickle-scanning"),h(Y,"class","header-link block pr-1.5 text-lg no-hover:hidden with-hover:absolute with-hover:p-1.5 with-hover:opacity-0 with-hover:group-hover:opacity-100 with-hover:right-full"),h(Y,"href","#pickle-scanning"),h(Q,"class","relative group"),h(Ol,"href","https://github.com/huggingface/safetensors"),h(Ol,"rel","nofollow"),h(L,"id","what-is-a-pickle"),h(L,"class","header-link block pr-1.5 text-lg no-hover:hidden with-hover:absolute with-hover:p-1.5 with-hover:opacity-0 with-hover:group-hover:opacity-100 with-hover:right-full"),h(L,"href","#what-is-a-pickle"),h(_,"class","relative group"),h(vl,"href","https://docs.python.org/3/library/pickle.html"),h(vl,"rel","nofollow"),h(bl,"href","https://docs.python.org/3/library/pickletools.html"),h(bl,"rel","nofollow"),h(X,"id","why-is-it-dangerous"),h(X,"class","header-link block pr-1.5 text-lg no-hover:hidden with-hover:absolute with-hover:p-1.5 with-hover:opacity-0 with-hover:group-hover:opacity-100 with-hover:right-full"),h(X,"href","#why-is-it-dangerous"),h(R,"class","relative group"),h(_l,"href","https://github.com/trailofbits/fickling"),h(_l,"rel","nofollow"),h(ll,"id","mitigation-strategies"),h(ll,"class","header-link block pr-1.5 text-lg no-hover:hidden with-hover:absolute with-hover:p-1.5 with-hover:opacity-0 with-hover:group-hover:opacity-100 with-hover:right-full"),h(ll,"href","#mitigation-strategies"),h(F,"class","relative group"),h(el,"id","load-files-from-users-and-organizations-you-trust"),h(el,"class","header-link block pr-1.5 text-lg no-hover:hidden with-hover:absolute with-hover:p-1.5 with-hover:opacity-0 with-hover:group-hover:opacity-100 with-hover:right-full"),h(el,"href","#load-files-from-users-and-organizations-you-trust"),h($,"class","relative group"),h(Re,"href","./security-gpg"),h(tl,"id","load-model-weights-from-tf-or-flax"),h(tl,"class","header-link block pr-1.5 text-lg no-hover:hidden with-hover:absolute with-hover:p-1.5 with-hover:opacity-0 with-hover:group-hover:opacity-100 with-hover:right-full"),h(tl,"href","#load-model-weights-from-tf-or-flax"),h(V,"class","relative group"),h(sl,"id","use-your-own-serialization-format"),h(sl,"class","header-link block pr-1.5 text-lg no-hover:hidden with-hover:absolute with-hover:p-1.5 with-hover:opacity-0 with-hover:group-hover:opacity-100 with-hover:right-full"),h(sl,"href","#use-your-own-serialization-format"),h(B,"class","relative group"),h(Pl,"href","https://msgpack.org/index.html"),h(Pl,"rel","nofollow"),h(Gl,"href","https://developers.google.com/protocol-buffers"),h(Gl,"rel","nofollow"),h(Wl,"href","https://capnproto.org/"),h(Wl,"rel","nofollow"),h(zl,"href","https://avro.apache.org/"),h(zl,"rel","nofollow"),h(Zl,"href","https://github.com/huggingface/safetensors"),h(Zl,"rel","nofollow"),h(ol,"id","improve-torchloadsave"),h(ol,"class","header-link block pr-1.5 text-lg no-hover:hidden with-hover:absolute with-hover:p-1.5 with-hover:opacity-0 with-hover:group-hover:opacity-100 with-hover:right-full"),h(ol,"href","#improve-torchloadsave"),h(x,"class","relative group"),h(Ll,"href","https://github.com/pytorch/pytorch/issues/52181"),h(Ll,"rel","nofollow"),h(rl,"id","hubs-security-scanner"),h(rl,"class","header-link block pr-1.5 text-lg no-hover:hidden with-hover:absolute with-hover:p-1.5 with-hover:opacity-0 with-hover:group-hover:opacity-100 with-hover:right-full"),h(rl,"href","#hubs-security-scanner"),h(S,"class","relative group"),h(nl,"id","what-we-have-now"),h(nl,"class","header-link block pr-1.5 text-lg no-hover:hidden with-hover:absolute with-hover:p-1.5 with-hover:opacity-0 with-hover:group-hover:opacity-100 with-hover:right-full"),h(nl,"href","#what-we-have-now"),h(P,"class","relative group"),h(ql,"href","https://www.clamav.net"),h(ql,"rel","nofollow"),h(xe,"class","block dark:hidden"),oc(xe.src,Dn="https://huggingface.co/datasets/huggingface/documentation-images/resolve/main/hub/security-pickle-imports.png")||h(xe,"src",Dn),h(Se,"class","hidden dark:block"),oc(Se.src,gn="https://huggingface.co/datasets/huggingface/documentation-images/resolve/main/hub/security-pickle-imports-dark.png")||h(Se,"src",gn),h(G,"class","flex justify-center"),h(Kl,"href","https://docs.python.org/3/library/pickletools.html#pickletools.genops"),h(Kl,"rel","nofollow"),h(Tl,"id","potential-solutions"),h(Tl,"class","header-link block pr-1.5 text-lg no-hover:hidden with-hover:absolute with-hover:p-1.5 with-hover:opacity-0 with-hover:group-hover:opacity-100 with-hover:right-full"),h(Tl,"href","#potential-solutions"),h(W,"class","relative group"),h(te,"href","https://docs.python.org/3/library/pickle.html#pickle.Unpickler"),h(te,"rel","nofollow"),h(se,"href","https://github.com/facebookresearch/CrypTen/blob/main/crypten/common/serial.py"),h(se,"rel","nofollow"),h(ie,"href","https://ctftime.org/writeup/16723"),h(ie,"rel","nofollow"),h(Ml,"id","further-reading"),h(Ml,"class","header-link block pr-1.5 text-lg no-hover:hidden with-hover:absolute with-hover:p-1.5 with-hover:opacity-0 with-hover:group-hover:opacity-100 with-hover:right-full"),h(Ml,"href","#further-reading"),h(z,"class","relative group"),h(ae,"href","https://docs.python.org/3/library/pickle.html#what-can-be-pickled-and-unpickled"),h(ae,"rel","nofollow"),h(re,"href","https://intoli.com/blog/dangerous-pickles/"),h(re,"rel","nofollow"),h(ne,"href","https://github.com/trailofbits/fickling"),h(ne,"rel","nofollow"),h(pe,"href","https://davidhamann.de/2020/04/05/exploiting-python-pickle/"),h(pe,"rel","nofollow"),h(he,"href","https://github.com/python/cpython/blob/3.10/Lib/pickletools.py"),h(he,"rel","nofollow"),h(ce,"href","https://github.com/python/cpython/blob/3.10/Lib/pickle.py"),h(ce,"rel","nofollow"),h(fe,"href","https://github.com/facebookresearch/CrypTen/blob/main/crypten/common/serial.py"),h(fe,"rel","nofollow"),h(Te,"href","https://ctftime.org/writeup/16723"),h(Te,"rel","nofollow"),h(ye,"href","https://github.com/moreati/pickle-fuzz"),h(ye,"rel","nofollow")},m(l,a){t(document.head,j),p(l,ws,a),p(l,Q,a),t(Q,Y),t(Y,ot),u(kl,ot,null),t(Q,Uo),t(Q,at),t(at,wo),p(l,Ms,a),p(l,Ue,a),t(Ue,Mo),p(l,Js,a),p(l,v,a),t(v,Jo),t(v,rt),t(rt,mo),t(v,ko),t(v,Ol),t(Ol,nt),t(nt,Oo),t(v,Io),p(l,ds,a),p(l,_,a),t(_,L),t(L,pt),u(Il,pt,null),t(_,vo),t(_,ht),t(ht,Ao),p(l,ms,a),p(l,H,a),t(H,Co),t(H,vl),t(vl,Eo),t(H,bo),p(l,ks,a),p(l,we,a),t(we,Al),t(Al,Do),t(Al,ct),t(ct,go),t(Al,jo),p(l,Os,a),p(l,Me,a),t(Me,Qo),p(l,Is,a),p(l,Je,a),t(Je,_o),p(l,vs,a),p(l,de,a),t(de,Ro),p(l,As,a),p(l,me,a),t(me,No),p(l,Cs,a),u(Cl,l,a),p(l,Es,a),p(l,ke,a),t(ke,Fo),p(l,bs,a),u(El,l,a),p(l,Ds,a),p(l,A,a),t(A,$o),t(A,bl),t(bl,Vo),t(A,Bo),t(A,ft),t(ft,Tt),t(Tt,xo),t(A,So),p(l,gs,a),p(l,Oe,a),t(Oe,Po),p(l,js,a),p(l,R,a),t(R,X),t(X,yt),u(Dl,yt,null),t(R,Go),t(R,ut),t(ut,Wo),p(l,Qs,a),p(l,Ie,a),t(Ie,zo),p(l,_s,a),p(l,ve,a),t(ve,Zo),p(l,Rs,a),u(gl,l,a),p(l,Ns,a),p(l,q,a),t(q,Yo),t(q,Ut),t(Ut,Lo),t(q,Ho),p(l,Fs,a),u(jl,l,a),p(l,$s,a),p(l,Ae,a),t(Ae,Xo),p(l,Vs,a),p(l,Ce,a),t(Ce,qo),p(l,Bs,a),u(Ql,l,a),p(l,xs,a),p(l,C,a),t(C,Ko),t(C,_l),t(_l,la),t(C,ea),t(C,wt),t(wt,ta),t(C,sa),p(l,Ss,a),p(l,K,a),t(K,ia),t(K,Mt),t(Mt,oa),t(K,aa),p(l,Ps,a),u(Rl,l,a),p(l,Gs,a),p(l,Ee,a),t(Ee,ra),p(l,Ws,a),u(Nl,l,a),p(l,zs,a),p(l,be,a),t(be,na),p(l,Zs,a),u(Fl,l,a),p(l,Ys,a),p(l,d,a),t(d,pa),t(d,Jt),t(Jt,ha),t(d,ca),t(d,dt),t(dt,fa),t(d,Ta),t(d,mt),t(mt,ya),t(d,ua),p(l,Ls,a),p(l,I,a),t(I,kt),t(kt,Ua),t(I,wa),t(I,Ot),t(Ot,Ma),t(I,Ja),t(I,It),t(It,da),t(I,ma),p(l,Hs,a),p(l,De,a),t(De,ka),p(l,Xs,a),p(l,E,a),t(E,vt),t(vt,Oa),t(E,Ia),t(E,N),t(N,va),t(N,At),t(At,Aa),t(N,Ca),t(N,Ct),t(Ct,Ea),t(N,ba),t(E,Da),t(E,Et),t(Et,ga),p(l,qs,a),p(l,ge,a),t(ge,ja),p(l,Ks,a),p(l,F,a),t(F,ll),t(ll,bt),u($l,bt,null),t(F,Qa),t(F,Dt),t(Dt,_a),p(l,li,a),p(l,je,a),t(je,gt),t(gt,jt),t(jt,Ra),p(l,ei,a),p(l,Qe,a),t(Qe,Na),p(l,ti,a),p(l,_e,a),t(_e,Fa),p(l,si,a),p(l,$,a),t($,el),t(el,Qt),u(Vl,Qt,null),t($,$a),t($,_t),t(_t,Va),p(l,ii,a),p(l,b,a),t(b,Ba),t(b,Re),t(Re,xa),t(b,Sa),t(b,Rt),t(Rt,Pa),t(b,Ga),p(l,oi,a),p(l,Ne,a),t(Ne,Wa),p(l,ai,a),p(l,V,a),t(V,tl),t(tl,Nt),u(Bl,Nt,null),t(V,za),t(V,Ft),t(Ft,Za),p(l,ri,a),p(l,m,a),t(m,Ya),t(m,$t),t($t,La),t(m,Ha),t(m,Vt),t(Vt,Xa),t(m,qa),t(m,Bt),t(Bt,Ka),t(m,lr),p(l,ni,a),p(l,Fe,a),t(Fe,er),p(l,pi,a),u(xl,l,a),p(l,hi,a),p(l,B,a),t(B,sl),t(sl,xt),u(Sl,xt,null),t(B,tr),t(B,St),t(St,sr),p(l,ci,a),p(l,J,a),t(J,Pt),t(Pt,Pl),t(Pl,ir),t(J,or),t(J,Gt),t(Gt,Gl),t(Gl,ar),t(J,rr),t(J,Wt),t(Wt,Wl),t(Wl,nr),t(J,pr),t(J,zt),t(zt,zl),t(zl,hr),t(J,cr),t(J,Zt),t(Zt,Zl),t(Zl,fr),p(l,fi,a),p(l,il,a),t(il,Tr),t(il,Yt),t(Yt,yr),t(il,ur),p(l,Ti,a),p(l,x,a),t(x,ol),t(ol,Lt),u(Yl,Lt,null),t(x,Ur),t(x,$e),t($e,wr),t($e,Ht),t(Ht,Mr),p(l,yi,a),p(l,al,a),t(al,Jr),t(al,Ll),t(Ll,dr),t(al,mr),p(l,ui,a),p(l,S,a),t(S,rl),t(rl,Xt),u(Hl,Xt,null),t(S,kr),t(S,qt),t(qt,Or),p(l,Ui,a),p(l,P,a),t(P,nl),t(nl,Kt),u(Xl,Kt,null),t(P,Ir),t(P,ls),t(ls,vr),p(l,wi,a),p(l,Ve,a),t(Ve,Ar),p(l,Mi,a),p(l,pl,a),t(pl,es),t(es,Cr),t(pl,Er),t(pl,ts),t(ts,br),p(l,Ji,a),p(l,hl,a),t(hl,Dr),t(hl,ql),t(ql,gr),t(hl,jr),p(l,di,a),p(l,cl,a),t(cl,Qr),t(cl,ss),t(ss,_r),t(cl,Rr),p(l,mi,a),p(l,Be,a),t(Be,Nr),p(l,ki,a),p(l,G,a),t(G,xe),t(G,Fr),t(G,Se),p(l,Oi,a),p(l,fl,a),t(fl,$r),t(fl,Kl),t(Kl,is),t(is,Vr),t(fl,Br),p(l,Ii,a),p(l,D,a),t(D,xr),t(D,os),t(os,Sr),t(D,Pr),t(D,as),t(as,Gr),t(D,Wr),p(l,vi,a),p(l,le,a),t(le,rs),t(rs,ns),t(ns,zr),t(le,Zr),p(l,Ai,a),p(l,W,a),t(W,Tl),t(Tl,ps),u(ee,ps,null),t(W,Yr),t(W,hs),t(hs,Lr),p(l,Ci,a),p(l,k,a),t(k,Hr),t(k,te),t(te,Xr),t(k,qr),t(k,se),t(se,Kr),t(k,ln),t(k,ie),t(ie,en),t(k,tn),p(l,Ei,a),p(l,yl,a),t(yl,sn),t(yl,cs),t(cs,on),t(yl,an),p(l,bi,a),p(l,ul,a),t(ul,rn),t(ul,fs),t(fs,nn),t(ul,pn),p(l,Di,a),p(l,Ul,a),t(Ul,hn),t(Ul,Ts),t(Ts,cn),t(Ul,fn),p(l,gi,a),p(l,wl,a),t(wl,Tn),t(wl,ys),t(ys,yn),t(wl,un),p(l,ji,a),p(l,z,a),t(z,Ml),t(Ml,us),u(oe,us,null),t(z,Un),t(z,Us),t(Us,wn),p(l,Qi,a),p(l,Pe,a),t(Pe,ae),t(ae,Mn),p(l,_i,a),p(l,Ge,a),t(Ge,re),t(re,Jn),p(l,Ri,a),p(l,We,a),t(We,ne),t(ne,dn),p(l,Ni,a),p(l,ze,a),t(ze,pe),t(pe,mn),p(l,Fi,a),p(l,Ze,a),t(Ze,he),t(he,kn),p(l,$i,a),p(l,Ye,a),t(Ye,ce),t(ce,On),p(l,Vi,a),p(l,Le,a),t(Le,fe),t(fe,In),p(l,Bi,a),p(l,He,a),t(He,Te),t(Te,vn),p(l,xi,a),p(l,Xe,a),t(Xe,ye),t(ye,An),Si=!0},p:hc,i(l){Si||(U(kl.$$.fragment,l),U(Il.$$.fragment,l),U(Cl.$$.fragment,l),U(El.$$.fragment,l),U(Dl.$$.fragment,l),U(gl.$$.fragment,l),U(jl.$$.fragment,l),U(Ql.$$.fragment,l),U(Rl.$$.fragment,l),U(Nl.$$.fragment,l),U(Fl.$$.fragment,l),U($l.$$.fragment,l),U(Vl.$$.fragment,l),U(Bl.$$.fragment,l),U(xl.$$.fragment,l),U(Sl.$$.fragment,l),U(Yl.$$.fragment,l),U(Hl.$$.fragment,l),U(Xl.$$.fragment,l),U(ee.$$.fragment,l),U(oe.$$.fragment,l),Si=!0)},o(l){w(kl.$$.fragment,l),w(Il.$$.fragment,l),w(Cl.$$.fragment,l),w(El.$$.fragment,l),w(Dl.$$.fragment,l),w(gl.$$.fragment,l),w(jl.$$.fragment,l),w(Ql.$$.fragment,l),w(Rl.$$.fragment,l),w(Nl.$$.fragment,l),w(Fl.$$.fragment,l),w($l.$$.fragment,l),w(Vl.$$.fragment,l),w(Bl.$$.fragment,l),w(xl.$$.fragment,l),w(Sl.$$.fragment,l),w(Yl.$$.fragment,l),w(Hl.$$.fragment,l),w(Xl.$$.fragment,l),w(ee.$$.fragment,l),w(oe.$$.fragment,l),Si=!1},d(l){e(j),l&&e(ws),l&&e(Q),M(kl),l&&e(Ms),l&&e(Ue),l&&e(Js),l&&e(v),l&&e(ds),l&&e(_),M(Il),l&&e(ms),l&&e(H),l&&e(ks),l&&e(we),l&&e(Os),l&&e(Me),l&&e(Is),l&&e(Je),l&&e(vs),l&&e(de),l&&e(As),l&&e(me),l&&e(Cs),M(Cl,l),l&&e(Es),l&&e(ke),l&&e(bs),M(El,l),l&&e(Ds),l&&e(A),l&&e(gs),l&&e(Oe),l&&e(js),l&&e(R),M(Dl),l&&e(Qs),l&&e(Ie),l&&e(_s),l&&e(ve),l&&e(Rs),M(gl,l),l&&e(Ns),l&&e(q),l&&e(Fs),M(jl,l),l&&e($s),l&&e(Ae),l&&e(Vs),l&&e(Ce),l&&e(Bs),M(Ql,l),l&&e(xs),l&&e(C),l&&e(Ss),l&&e(K),l&&e(Ps),M(Rl,l),l&&e(Gs),l&&e(Ee),l&&e(Ws),M(Nl,l),l&&e(zs),l&&e(be),l&&e(Zs),M(Fl,l),l&&e(Ys),l&&e(d),l&&e(Ls),l&&e(I),l&&e(Hs),l&&e(De),l&&e(Xs),l&&e(E),l&&e(qs),l&&e(ge),l&&e(Ks),l&&e(F),M($l),l&&e(li),l&&e(je),l&&e(ei),l&&e(Qe),l&&e(ti),l&&e(_e),l&&e(si),l&&e($),M(Vl),l&&e(ii),l&&e(b),l&&e(oi),l&&e(Ne),l&&e(ai),l&&e(V),M(Bl),l&&e(ri),l&&e(m),l&&e(ni),l&&e(Fe),l&&e(pi),M(xl,l),l&&e(hi),l&&e(B),M(Sl),l&&e(ci),l&&e(J),l&&e(fi),l&&e(il),l&&e(Ti),l&&e(x),M(Yl),l&&e(yi),l&&e(al),l&&e(ui),l&&e(S),M(Hl),l&&e(Ui),l&&e(P),M(Xl),l&&e(wi),l&&e(Ve),l&&e(Mi),l&&e(pl),l&&e(Ji),l&&e(hl),l&&e(di),l&&e(cl),l&&e(mi),l&&e(Be),l&&e(ki),l&&e(G),l&&e(Oi),l&&e(fl),l&&e(Ii),l&&e(D),l&&e(vi),l&&e(le),l&&e(Ai),l&&e(W),M(ee),l&&e(Ci),l&&e(k),l&&e(Ei),l&&e(yl),l&&e(bi),l&&e(ul),l&&e(Di),l&&e(Ul),l&&e(gi),l&&e(wl),l&&e(ji),l&&e(z),M(oe),l&&e(Qi),l&&e(Pe),l&&e(_i),l&&e(Ge),l&&e(Ri),l&&e(We),l&&e(Ni),l&&e(ze),l&&e(Fi),l&&e(Ze),l&&e($i),l&&e(Ye),l&&e(Vi),l&&e(Le),l&&e(Bi),l&&e(He),l&&e(xi),l&&e(Xe)}}}const Tc={local:"pickle-scanning",sections:[{local:"what-is-a-pickle",title:"What is a pickle?"},{local:"why-is-it-dangerous",title:"Why is it dangerous?"},{local:"mitigation-strategies",sections:[{local:"load-files-from-users-and-organizations-you-trust",title:"Load files from users and organizations you trust"},{local:"load-model-weights-from-tf-or-flax",title:"Load model weights from TF or Flax"},{local:"use-your-own-serialization-format",title:"Use your own serialization format"},{local:"improve-torchloadsave",title:"Improve `torch.load/save`"},{local:"hubs-security-scanner",sections:[{local:"what-we-have-now",title:"What we have now"},{local:"potential-solutions",title:"Potential solutions"}],title:"Hub\u2019s Security Scanner"}],title:"Mitigation Strategies"},{local:"further-reading",title:"Further Reading"}],title:"Pickle Scanning"};function yc(bn){return cc(()=>{new URLSearchParams(window.location.search).get("fw")}),[]}class Mc extends ac{constructor(j){super();rc(this,j,yc,fc,nc,{})}}export{Mc as default,Tc as metadata};
