Safer loading

Hi! I was just studying chainer’s serialization/deserialization.

Very good job, but to make numpy loading safe one minor change needed:

from chainer.serializers import NpzDeserializer
def load_npz(file, obj, path='', strict=True):
    with numpy.load(file, allow_pickle=False) as f:
        d = NpzDeserializer(f, path=path, strict=strict)
        d.load(obj)

Please notice allow_pickle=False. By default, numpy.load allows using pickle, which can execute any code (pickle is very unsafe, that’s why can’t be used to share models, you probably know it).

I’ve checked that in my case this fix doesn’t break already saved models, so probably it is a good solution.

[toslunar]

The safety has become the default of NumPy >= 1.16.3. https://github.com/numpy/numpy/releases/tag/v1.16.3

Unpickling while loading requires explicit opt-in

The functions np.load, and np.lib.format.read_array take an allow_pickle keyword which now defaults to False in response to CVE-2019-6446 <https://nvd.nist.gov/vuln/detail/CVE-2019-6446>_.

[arogozhnikov]

Closing since it was already fixed on numpy side. (thanks to @toslunar for pointing this)