Fickling vulnerable to detection bypass due to "builtins" blindness

@@ -1110,12 +1110,8 @@ def attr(self) -> str:
 
     def run(self, interpreter: Interpreter):
         module, attr = self.module, self.attr
-        if module in ("__builtin__", "__builtins__", "builtins"):
-            # no need to emit an import for builtins!
-            pass
-        else:
-            alias = ast.alias(attr)
-            interpreter.module_body.append(ast.ImportFrom(module=module, names=[alias], level=0))
+        alias = ast.alias(attr)
+        interpreter.module_body.append(ast.ImportFrom(module=module, names=[alias], level=0))
         interpreter.stack.append(ast.Name(attr, ast.Load()))
 
     def encode(self) -> bytes:
@@ -1166,13 +1162,8 @@ def run(self, interpreter: Interpreter):
                 f"Module: {module!r}, Attr: {attr!r}"
             )
 
-        # Continue with normal processing
-        if module in ("__builtin__", "__builtins__", "builtins"):
-            # no need to emit an import for builtins!
-            pass
-        else:
-            alias = ast.alias(attr)
-            interpreter.module_body.append(ast.ImportFrom(module=module, names=[alias], level=0))
+        alias = ast.alias(attr)
+        interpreter.module_body.append(ast.ImportFrom(module=module, names=[alias], level=0))
         interpreter.stack.append(ast.Name(attr, ast.Load()))
 
 
@@ -1194,12 +1185,8 @@ def cls(self) -> str:
 
     def run(self, interpreter: Interpreter, stack_slice: List[ast.expr]):
         module, classname = self.module, self.cls
-        if module in ("__builtin__", "__builtins__", "builtins"):
-            # no need to emit an import for builtins!
-            pass
-        else:
-            alias = ast.alias(classname)
-            interpreter.module_body.append(ast.ImportFrom(module=module, names=[alias], level=0))
+        alias = ast.alias(classname)
+        interpreter.module_body.append(ast.ImportFrom(module=module, names=[alias], level=0))
         args = ast.Tuple(tuple(stack_slice))
         call = ast.Call(ast.Name(classname, ast.Load()), list(args.elts), [])
         var_name = interpreter.new_variable(call)

@@ -345,3 +345,34 @@ def test_missing_multiprocessing(self):
             res.detailed_results()["AnalysisResult"].get("UnsafeImports"),
             "from multiprocessing.util import spawnv_passfds",
         )
+
+    # https://github.com/trailofbits/fickling/security/advisories/GHSA-h4rm-mm56-xf63
+    def test_builtins_import_bypass(self):
+        pickled = Pickled(
+            [
+                op.Global("builtins __import__"),
+                op.String("os"),
+                op.TupleOne(),
+                op.Reduce(),
+                op.Put(0),
+                op.Pop(),
+                op.Global("builtins getattr"),
+                op.Get(0),
+                op.String("system"),
+                op.TupleTwo(),
+                op.Reduce(),
+                op.Put(1),
+                op.Pop(),
+                op.Get(1),
+                op.String("whoami"),
+                op.TupleOne(),
+                op.Reduce(),
+                op.Stop(),
+            ]
+        )
+        res = check_safety(pickled)
+        self.assertGreater(res.severity, Severity.LIKELY_SAFE)
+        self.assertEqual(
+            res.detailed_results()["AnalysisResult"].get("UnsafeImports"),
+            "from builtins import getattr",
+        )

@@ -87,7 +87,7 @@ def test_bytes(self):
     def test_call(self):
         pickled = Pickled(
             [
-                fpickle.Global.create("__builtins__", "eval"),
+                fpickle.Global.create("builtins", "eval"),
                 fpickle.Mark(),
                 fpickle.Unicode("(lambda:1234)()"),
                 fpickle.Tuple(),
@@ -102,7 +102,7 @@ def test_inst(self):
             [
                 fpickle.Mark(),
                 fpickle.Unicode("1234"),
-                fpickle.Inst.create("__builtins__", "int"),
+                fpickle.Inst.create("builtins", "int"),
                 fpickle.Stop(),
             ]
         )