Restricted checkpoint decoding currently permits non-type globals through auto-allowed module prefixes. The built-in getattr reconstruction path can also traverse attributes beyond the intended type allowlist. Together, these behaviors can expose unintended callables while deserializing a crafted checkpoint.
Expected behavior: restricted decoding accepts only permitted types, explicitly permitted nested types, and narrowly supported enum-member reconstruction. Non-type globals and unrelated attribute traversal should raise an unpickling error.
Addressed by #5923.
Restricted checkpoint decoding currently permits non-type globals through auto-allowed module prefixes. The built-in getattr reconstruction path can also traverse attributes beyond the intended type allowlist. Together, these behaviors can expose unintended callables while deserializing a crafted checkpoint.
Expected behavior: restricted decoding accepts only permitted types, explicitly permitted nested types, and narrowly supported enum-member reconstruction. Non-type globals and unrelated attribute traversal should raise an unpickling error.
Addressed by #5923.