4 ms·
No Python program should ever try to unpickle data from an untrusted source.
by NelsonMinar 14y ago
No Python program should ever try to unpickle data from an untrusted source.
- nezza-_- 14y agoIt's signed, so the integrity is ensured as long as the secret key stays secret.
- slurgfest 14y agoThere was never any good reason to use pickle for this, though..
- alxv 14y agoThere is a way to harden pickle to protect it against the most basic exploits: http://docs.python.org/py3k/library/pickle.html#restricting-globals http://docs.python.org/py3k/library/pickle.html#restricting-... It is not a complete solution, as an attacker could still DoS your service by making pickle allocate a huge amount of memory, but at least that's better than allowing arbitrary code execution.