Affected: trailofbits fickling

Fickling is a Python pickling decompiler and static analyzer. Prior to version 0.1.7, Fickling is vulnerable to detection bypass due to "builtins" blindness. This issue has been patched in version 0.1.7.

Affected: PyPI: fickling

#Fickling's assessment

Fickling started emitting AST nodes for builtins imports in order to match them during analysis (https://github.com/trailofbits/fickling/commit/9f309ab834797f280cb5143a2f6f987579fa7cdf).

# Original report

### Summary Fickling works by Pickle bytecode --> AST --> Security analysis However while going from bytecode to AST, some import nodes are removed which blinds the security analysis

fickling/fickling/fickle.py ```python def run(self, interpreter: Interpreter): module, attr = self.module, self.attr if module in ("__builtin__", "__builtins__", "builtins"): # no need to emit an import for builtins! pass else: alias = ast.alias(attr) interpreter.module_body.append(ast.ImportFrom(module=module, names=[alias], level=0)) interpreter.stack.append(ast.Name(attr, ast.Load()))

def encode(self) -> bytes: return f"c{self.module}\n{self.attr}\n".encode() ``` Here we see that no import nodes are emitted for builtins However builtins is marked as an unsafe import

fickling/fickling/analysis.py ```python UNSAFE_MODULES = { "__builtin__": "This module contains dangerous functions that can execute arbitrary code.", "__builtins__": "This module contains dangerous functions that can execute arbitrary code.", "builtins": "This module contains dangerous functions that can execute arbitrary code.", ```

But because there are no import nodes for built…