3 ms·
There is nothing stopping you from storing just strings or bytes having safe representations.
by OutOfHere 2y ago
There is nothing stopping you from storing just strings or bytes having safe representations.
- ysleepy 2y agoThe same way that it's fine to use `eval()` to parse JSON I assume.
- OutOfHere 2y agoThis thread has bastardized serialization with storage even though the two are orthogonal concepts. If you don't want shelve to unpickle a hazardous object, give it a string or byte representation.
- Dunedan 2y agoAnd that's exactly why it's so dangerous to use pickle, because it doesn't prevent you from executing untrusted code. It doesn't matter if you only pickle strings and bytes, as long as you unpickle any data, an attacker can replace that data with something which results in arbitrary code execution. If you only want to store bytes, the safe way to do so is to use the dbm module directly, which doesn't pickle/unpickle the data you provide.
- OutOfHere 2y agoI find pickle useful for trusted objects that I created myself. pkl.xz is for example a fast way to reproducibly store and read Pandas dataframes. I have also found pickle useful for custom serialization of some objects that needed it.