4 ms·
nice examples. just a note, pickle shouldn't be used for serialization if the source is untrusted.
by omakase 19y ago
nice examples. just a note, pickle shouldn't be used for serialization if the source is untrusted.
- pmorici 19y agoSource of what? Do you care to elaborate...?
- kirubakaran 19y agohttp://www.python.org/doc/2.2.3/lib/pickle-sec.html http://www.python.org/doc/2.2.3/lib/pickle-sec.html
- ntoshev 19y agoSo add another step: sign the pickled data and check that upon arrival.
- omakase 19y agosorry i didn't elaborate, it isn't a question of signing requests, kirubakaran posted a link below that explains the basics (unpickling can create objects and run potentially harmful methods) depending on what you are sending there are several alternatives for serializing data. there are a handful of json libraries to take a look at and some good benchmarks if you google for them.
- icky 19y ago> sorry i didn't elaborate, it isn't a question of signing requests, kirubakaran posted a link below that explains the basics (unpickling can create objects and run potentially harmful methods) Parent poster meant signing the pickled data as a text stream, not as a collection of unserialized python objects. If the signatures don't match, you just discard the data, and don't unpickle it. This guarantees that (as long as your keys aren't compromised, and your signing algorithm is unbroken) you will never unpickle tampered-with data.