fix: reject compressed wrapper raw trailers

[mldangelo-oai]

Summary

This PR continues the picklescan/container audit stack with a fail-closed compressed-wrapper fix. Python bzip2 and xz readers can return the valid first decompressed member while silently consuming raw trailing bytes. For .pkl.bz2 and .pkl.xz wrappers, that could let a benign first pickle hide an unscanned malicious pickle trailer.

Root cause: CompressedScanner used high-level BZ2File and LZMAFile readers for standalone bzip2/xz wrappers. Those readers support convenient streaming, but they do not expose enough member-boundary state for us to distinguish valid concatenated members from raw trailing data. The new low-level loops also needed chunk-sized per-call output probes so configured decompression limits cannot still permit one oversized allocation.

Fix:

• Add bounded low-level decompression loops for bzip2 and xz.
• Preserve max decompressed byte and decompression ratio enforcement.
• Preserve support for concatenated valid bzip2/xz members.
• Reject raw or corrupt trailing bytes after a valid bzip2/xz member.
• Cap bzip2, xz, and zlib per-call decompression output probes to the configured chunk size.
• Add an Unreleased changelog note.
• Add fail-closed trailer regressions, benign concatenated-member regressions, and per-call decompression probe coverage.

Validation

• uv run pytest tests/scanners/test_compressed_scanner.py -q --tb=short
• uv run pytest tests/scanners/test_compressed_scanner.py tests/test_core.py tests/scanners/test_scanner_registry.py tests/utils/file/test_filetype.py -q --tb=short
• uv run ruff format modelaudit/ packages/modelaudit-picklescan/src packages/modelaudit-picklescan/tests tests/
• uv run ruff check --fix modelaudit/ packages/modelaudit-picklescan/src packages/modelaudit-picklescan/tests tests/
• uv run ruff format --check modelaudit/ packages/modelaudit-picklescan/src packages/modelaudit-picklescan/tests tests/
• uv run mypy modelaudit/ packages/modelaudit-picklescan/src packages/modelaudit-picklescan/tests tests/
• uv run pytest -n auto -m "not slow and not integration" --maxfail=1

Full local result: 3376 passed, 75 skipped, 16 warnings.

[coderabbitai]

Important

Review skipped

Auto reviews are disabled on base/target branches other than the default branch.

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Repository UI

Review profile: ASSERTIVE

Plan: Pro

Run ID: 026b9b29-4416-43b5-a1bd-14fc4b662fc9

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch mdangelo/codex/compressed-trailer-audit

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

[github-actions]

Workflow run and artifacts

Performance Benchmarks

Compared 6 shared benchmarks with a regression threshold of 15%.
Status: 0 regressions, 0 improved, 6 stable, 0 new, 0 missing.
Aggregate shared-benchmark median: 684.41ms -> 690.64ms (+0.9%).

Benchmark	Target	Size	Files	Baseline	Current	Change	Status
tests/benchmarks/test_scan_benchmarks.py::test_validate_file_type_pytorch_zip	state_dict.pt	1.5 MiB	1	48.8us	47.8us	-2.1%	stable
tests/benchmarks/test_scan_benchmarks.py::test_scan_safe_pickle	safe_model.pkl	49.4 KiB	1	27.81ms	28.19ms	+1.4%	stable
tests/benchmarks/test_scan_benchmarks.py::test_detect_file_format_safe_pickle	safe_model.pkl	49.4 KiB	1	166.8us	164.5us	-1.3%	stable
tests/benchmarks/test_scan_benchmarks.py::test_scan_pytorch_zip	state_dict.pt	1.5 MiB	1	33.61ms	33.99ms	+1.1%	stable
tests/benchmarks/test_scan_benchmarks.py::test_scan_duplicate_directory	duplicate-corpus	840.0 KiB	81	486.75ms	491.54ms	+1.0%	stable
tests/benchmarks/test_scan_benchmarks.py::test_scan_mixed_directory	mixed-corpus	1.7 MiB	54	136.01ms	136.71ms	+0.5%	stable

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: b4a44225d0

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".