erp5_wendelin: do not load pickles when converting wendelin text format to numpy

Base_wendelinTextToNumpy just takes a string and pass it to numpy.load,
but numpy.load will load pickles (problem from https://github.com/numpy/numpy/issues/12759 ).
Therefore we disallow loading pickles here until this becomes the
default in newer numpy versions.
Co-authored-by: Jérome Perrin <jerome@nexedi.com>

bt5/erp5_wendelin/SkinTemplateItem/portal_skins/erp5_wendelin/Base_wendelinDataToNumpy.py

@@ -21,6 +21,6 @@ assert checksum == binascii.crc32(data[HEADER_LEN:])
 io = StringIO()
 io.write(data[HEADER_LEN:])
 io.seek(0)
-array = np.load(io)
+array = np.load(io, allow_pickle=False)
 io.close()
 return array

bt5/erp5_wendelin/TestTemplateItem/portal_components/test.erp5.testWendelin.py

@@ -21,6 +21,7 @@
 ##############################################################################
 
 from cStringIO import StringIO
+import base64
 import binascii
 import msgpack
 import numpy as np
@@ -865,3 +866,15 @@ result = [x for x in data_bucket_stream.getBucketIndexKeySequenceByIndex()]
     self.assertEqual(diff_object_list, [['/usr/bin/2to3-2.7', 'ModifiedValue', 'fade8568285eb14146a7244', 'f631570af55ee08ecef78f3'],
                                         ['/usr/bin/R', 'b4c48d52345ae2eb7ca0455db', '59441ddbc00b6521da571', 'a92be1a7acc03f3846'],
                                         ['/usr/bin/Rscript', 'e97842e556f90be5f7e5', '806725443a01bcae802','1829d887e0c3380ec8f463527']])
+
+
+  def test_18_wendelinTextToNumpySecurity(self):
+    """
+      Test that we do not load pickles when converting encoded wendelin data to numpy.
+    """
+    portal = self.portal
+    ndarray = np.array([[0, 1], [2, object()]])
+    wendelin_text = base64.b64encode(portal.Base_numpyToWendelinData(ndarray))
+    self.assertRaises(ValueError,
+                      portal.Base_wendelinTextToNumpy,
+                      wendelin_text)