Restrict backend key unpickling

[dipeshbabu]

What

Route synchronous and asynchronous LSH key serialization through a restricted loader that rejects global construction opcodes, persistent IDs, and non-hashable results. Validate keys before insertion and document the supported key types and migration impact.

Why

Redis and other external backends can return tampered bytes. Passing those bytes to the standard pickle loader can invoke attacker-selected global callables during a query.

Impact

Primitive built-in keys continue to round-trip. Custom class keys now fail before insertion, and existing indexes using them must migrate to supported built-in values. Malicious or corrupt backend values raise an unpickling error without executing their payload.

Root cause

Backend data was treated as trusted and decoded with unrestricted pickle.loads calls.

Checks

• uv run pytest -q test/test_lsh.py test/test_lshensemble.py test/test_integration.py test/aio/test_lsh.py (33 passed, 94 backend-service tests skipped locally)
• executable-payload regression confirms no side effect occurs
• uv run ruff check on changed Python files
• uvx pyright (0 errors)
• uv run python -m compileall -q datasketch
• git diff --check

[dipeshbabu]

Superseded by upstream pull request ekzhu#329.