Bump version to 0.0.10

mmaitre314 · Jul 16, 2023 · e0809b4 · e0809b4
1 parent e99f3ae
commit e0809b4
Show file tree

Hide file tree

Showing 3 changed files with 8 additions and 2 deletions.
diff --git a/README.md b/README.md
@@ -92,6 +92,7 @@ Tested on `Linux 5.10.102.1-microsoft-standard-WSL2 x86_64` (WSL2).
 
 ## References
 
+- [pickletools.py](https://github.com/python/cpython/blob/main/Lib/pickletools.py) -- The pickletool code is the most detailed documentation of the Pickle format.
 - [Machine Learning Attack Series: Backdooring Pickle Files](https://embracethered.com/blog/posts/2022/machine-learning-attack-series-injecting-code-pickle-files/), Johann Rehberger, 2022
 - [Hugging Face Pickle Scanning](https://huggingface.co/docs/hub/security-pickle), Luc Georges, 2022
 - [The hidden dangers of loading open-source AI models (ARBITRARY CODE EXPLOIT!](https://www.youtube.com/watch?v=2ethDz9KnLk), Yannic Kilcher, 2022

diff --git a/setup.cfg b/setup.cfg
@@ -1,6 +1,6 @@
 [metadata]
 name = picklescan
-version = 0.0.9
+version = 0.0.10
 author = Matthieu Maitre
 author_email = mmaitre314@users.noreply.github.com
 description = Security scanner detecting Python Pickle files performing suspicious actions

diff --git a/src/picklescan/scanner.py b/src/picklescan/scanner.py
@@ -197,7 +197,12 @@ def _list_globals(data: IO[bytes], multiple_pickles=True) -> Set[Tuple[str, str]
             elif op_name == "STACK_GLOBAL":
                 values = []
                 for offset in range(1, n):
-                    if ops[n - offset][0].name in ["MEMOIZE", "PUT", "BINPUT", "LONG_BINPUT"]:
+                    if ops[n - offset][0].name in [
+                        "MEMOIZE",
+                        "PUT",
+                        "BINPUT",
+                        "LONG_BINPUT",
+                    ]:
                         continue
                     if ops[n - offset][0].name in ["GET", "BINGET", "LONG_BINGET"]:
                         values.append(memo[int(ops[n - offset][1])])