3 ms·

Pandas doesn't use the parquet python package under the hood: https://pandas.pydata.org/docs/reference/api/pandas.read_parquet.html https://pandas.pydata.org/do

Pandas doesn't use the parquet python package under the hood: https://pandas.pydata.org/docs/reference/api/pandas.read_parquet.html https://pandas.pydata.org/docs/reference/api/pandas.read_par... > Parquet library to use. If ‘auto’, then the option io.parquet.engine is used. The default io.parquet.engine behavior is to try ‘pyarrow’, falling back to ‘fastparquet’ if ‘pyarrow’ is unavailable. Those should be unaffected.

westurner 2y ago
Python pickles have the same issue but it is a design decision per the docs. Python docs > library > pickle: https://docs.python.org/3/library/pickle.html https://docs.python.org/3/library/pickle.html Re: a hypothetical pickle parser protocol that doesn't eval code at parse time; "skipcode pickle protocol 6: "AI Supply Chain Attack: How Malicious Pickle Files Backdoor Models" .. "Insecurity and Python Pickles" : https://news.ycombinator.com/item?id=43426963 https://news.ycombinator.com/item?id=43426963
- deleted 2y ago
  [deleted]
- echoangle 2y ago
  But python pickle is only supposed to be used with trusted input, so it’s not a vulnerability.