security: restrict pickle deserialization in v0 schema and migration tool

[daridor9]

Summary

This PR adds a RestrictedUnpickler to prevent arbitrary code execution via crafted pickle payloads in the v0 schema runtime path and the migration tool.

Fixes #5634

Changes

New: _safe_unpickle.py

• RestrictedUnpickler subclass that allowlists only known-safe types:
  • ADK model types (google.adk.*)
  • Google GenAI types (google.genai.*)
  • Pydantic internals (pydantic.*, pydantic_core.*)
  • Standard Python builtins and collections/datetime/copyreg
• Blocks all other globals (e.g., os, subprocess, posix, builtins.__import__)
• safe_loads() function as drop-in replacement for pickle.loads()
• Escape hatch: ADK_ALLOW_UNSAFE_V0_PICKLE=1 env var for databases with non-standard pickled types (logs deprecation warning)

Patched: v0.py (Sink 1 — runtime read path)

• DynamicPickleType.process_result_value() now calls safe_loads() instead of pickle.loads()
• Affects MySQL, Cloud Spanner, and SQLite dialects

Patched: migrate_from_sqlalchemy_pickle.py (Sink 2 — migration path)

• _row_to_event() now calls safe_loads() instead of pickle.loads()
• Ensures adk migrate session is safe to run on untrusted v0 databases

Testing

• Existing v0 databases with legitimate EventActions pickle data will continue to work — all ADK types are allowlisted
• Malicious pickle payloads (e.g., os.system, subprocess.Popen) are blocked with a clear error message
• The env var escape hatch provides a migration path for edge cases

Security Context

• Reported to Google VRP: 2026-04-24
• GHSA filed
• CVSS 3.1: 9.9 Critical (AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H)
• 90-day coordinated disclosure deadline: 2026-07-23

---

Submitted by SPR{K}3 Security Research (@daridor9)

[google-cla]

Thanks for your pull request! It looks like this may be your first contribution to a Google open source project. Before we can look at your pull request, you'll need to sign a Contributor License Agreement (CLA).

View this failed invocation of the CLA check for more information.

For the most up to date status, view the checks section at the bottom of the pull request.

[adk-bot]

Hello @daridor9, thank you for your contribution! This is a valuable security fix.

Before we can proceed with the review, could you please sign the Contributor License Agreement (CLA)? The cla/google check is currently failing. You can find details on how to sign it in our contribution guidelines.

Once the CLA is signed, we can move forward with labeling and reviewing your PR.

Response from ADK Triaging Agent