4 ms·
About Pickle— If we pickle a string which comes from an untrusted source, that’s fine right? There’s no way to format the string or anything such that it explo
by methodover 8y ago
About Pickle—
If we pickle a string which comes from an untrusted source, that’s fine right? There’s no way to format the string or anything such that it exploits any kind of vulnerability with pickle. Right?
- Rjevski 8y agoCorrect, although I’m happy to be proven wrong. I don’t see any way this could be possible - in order to create a malicious pickle object you’d have to have your untrusted input somehow “break outside” of its string container before it even gets pickled. But honestly, what’s the use-case for pickle that can’t be replaced with a safer string-based format like JSON?
- BerislavLopac 8y agoWell, pretty obviously, if your use case satisfies (most of) the following prerequisites, there is no reason to chose JSON over pickle: - you need to serialise arbitrary objects - you both read and write only using Python - your transfer protocol handles binary data (as opposed to plain text) - you don't need the serialisation to be human-readable - you want to be able to handle any Python type - you don't want to write your own serialization rules JSON is "safer" only if you have full control over deserialization.