[oliche]

Stacked on #71.

load_pickle used joblib.load, which runs arbitrary code from an untrusted pickle. It now uses a restricted joblib unpickler that only allows numpy arrays/dtypes/scalars and a few builtin types; anything else raises pickle.UnpicklingError. Object-dtype arrays are covered too. Requires joblib>=1.6 (pinned in requirements.txt and environment.yml), which routes nested object-array unpickling through find_class.

Behaviour changes: load_pickle no longer loads arbitrary objects, compressed files or memory-mapped arrays. save_pickle is unchanged, so existing files written by it still load.

Tests check that arrays and containers round-trip and that malicious payloads (bare, nested, hidden in an object array) are refused without executing.

[rossant]

Thanks for tackling this too! As far as I remember, Phy doesn’t use object-dtype arrays, so explicitly rejecting them seems reasonable.

Could you document that restriction and add a test rejecting a harmless object array? The current malicious object-array test fails at NumPy reconstruction, before reaching the malicious element, so it shouldn’t imply that filtering inside object arrays is supported.

Please also check the supported save_pickle output formats, including compression, and narrow the compatibility claims accordingly.