Detect mailcap.findmatch pickle payloads

src/picklescan/scanner.py

@@ -192,6 +192,7 @@ def __str__(self) -> str:
     "imaplib": {"IMAP4_stream"},  # IMAP4_stream executes commands via subprocess.Popen(command, shell=True)
     "lib2to3.pgen2.grammar": {"Grammar.loads"},
     "lib2to3.pgen2.pgen": {"ParserGenerator.make_label"},
+    "mailcap": {"findmatch"},  # mailcap.findmatch executes matching entry test commands via os.system()
     "pdb": "*",
     "pickle": "*",
     "_pickle": "*",

tests/test_scanner.py

@@ -42,6 +42,14 @@ def __reduce__(self):
         return os.system, ("ls -la",)
 
 
+class MaliciousMailcapFindmatch:
+    def __reduce__(self):
+        import mailcap
+
+        caps = {"text/plain": [{"view": "cat %s", "test": "true"}]}
+        return mailcap.findmatch, (caps, "text/plain")
+
+
 class HTTPResponse:
     def __init__(self, status, data=None):
         self.status = status
@@ -142,6 +150,12 @@ def test_scan_pickle_bytes():
     )
 
 
+def test_scan_pickle_bytes_flags_mailcap_findmatch():
+    assert scan_pickle_bytes(io.BytesIO(pickle.dumps(MaliciousMailcapFindmatch())), "mailcap.pkl") == ScanResult(
+        [Global("mailcap", "findmatch", SafetyLevel.Dangerous)], 1, 1, 1
+    )
+
+
 def test_scan_zip_bytes():
     buffer = io.BytesIO()
     with zipfile.ZipFile(buffer, "w") as zip: