4 ms·
Correct, although I’m happy to be proven wrong. I don’t see any way this could be possible - in order to create a malicious pickle object you’d have to have yo
by Rjevski 8y ago
Correct, although I’m happy to be proven wrong.
I don’t see any way this could be possible - in order to create a malicious pickle object you’d have to have your untrusted input somehow “break outside” of its string container before it even gets pickled.
But honestly, what’s the use-case for pickle that can’t be replaced with a safer string-based format like JSON?
- BerislavLopac 8y agoWell, pretty obviously, if your use case satisfies (most of) the following prerequisites, there is no reason to chose JSON over pickle: - you need to serialise arbitrary objects - you both read and write only using Python - your transfer protocol handles binary data (as opposed to plain text) - you don't need the serialisation to be human-readable - you want to be able to handle any Python type - you don't want to write your own serialization rules JSON is "safer" only if you have full control over deserialization.