Summary

LSUNClass caches the enumerated LMDB keys in a pickle file whose path is derived from root but resolved against the current working directory, and reads it back with pickle.load:

cache_file = "_cache_" + "".join(c for c in root if c in string.ascii_letters)
if os.path.isfile(cache_file):
    self.keys = pickle.load(open(cache_file, "rb"))
else:
    ...
    pickle.dump(self.keys, open(cache_file, "wb"))

This has two issues:

1. CWD-relative, predictable name. The cache is looked up in the process CWD, not under root, and the name is a lossy transform of root (letters only). A file dropped into the directory the user happens to run from — a shared scratch dir, a cloned example repo, a CI workspace — is loaded on the next LSUN()/LSUNClass() call. Because it's unpickled with no integrity check, that is arbitrary code execution on load (CWE-502). The user never asked to load anything; the cache is written and re-read as a side effect.
2. Unrestricted pickle even in the benign case.

Fix

This mirrors what the sibling datasets in this package already do (ImageNet, MNIST, PhotoTour all use torch.load(..., weights_only=True)):

• Store the cache next to the LMDB store as root/_cache_keys.pt — a trusted, per-class location, with no CWD exposure and no cross-root name collisions.
• Load with torch.load(..., weights_only=True), so a cache file can never execute code on load.
• Skip caching gracefully if root is read-only.

The cache only memoizes keys that are fully re-derivable from the trusted LMDB store, so pre-existing CWD caches are simply not found under the new path and are regenerated safely on first use — no migration required. torch.load round-trips the raw bytes LMDB keys, including non-UTF-8 keys.

Test plan

• Built an LMDB store containing a non-UTF-8 key; confirmed the keys enumerate, a _cache_keys.pt is written under root, and a second construction reads it back with the non-UTF-8 key intact.
• Confirmed a pre-existing _cache_<letters> file in the CWD is now ignored (the loader looks under root), so a poisoned CWD cache is no longer read.