Adds three sets of detections:
1. Code-shaped patterns. Expands the existing _check_suspicious_patterns
list with sandbox-escape, gadget, and serializer patterns:
__reduce__, __class__.__bases__, __class__.__subclasses__, __builtins__,
pickle.loads, marshal.loads, compile(), runpy, getattr(__builtins__.
2. Embedded pickle. New _check_embedded_pickle scans every string widget
value and flags HIGH if it base64-decodes to a pickle stream (protocol 2-5
detected via the leading 0x80 + version-byte signature). Catches pickle
payloads staged on generic string nodes before being routed to a
deserializer — complements the dedicated pickle-deserializer rule.
3. Path traversal. New _check_path_traversal flags references to sensitive
filesystem paths (/etc/passwd, /etc/shadow, ~/.ssh/id_rsa, AWS creds,
browser credential stores, /proc/self/environ, etc. — HIGH) and to
sensitive directories generally (/etc/, /root/, C:\Windows\System32 —
MEDIUM). Also flags >=3 levels of '../' traversal as MEDIUM. Single
'../' is left alone since it's common in legitimate relative paths.
Tests in tests/test_pattern_rules.py cover all three rule families plus
helper-function correctness for the base64/pickle heuristics.
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
