2 ms·
Pickle is Python's native object serialization. Unpickling user inputs is executing arbitrary code.
by anonymoushn 13y ago
Pickle is Python's native object serialization. Unpickling user inputs is executing arbitrary code.
- pekk 13y agoNot accurate, Python has multiple serialization libraries and there is nothing special about pickle. Python's internal serialization is 'marshal' and shouldn't be used by apps for other reasons
- dalke 13y agoanonymoushn said "object serialization". "marshal" doesn't serialize objects. >>> import marshal, cPickle >>> x = object() >>> marshal.dumps(x) Traceback (most recent call last): File "<stdin>", line 1, in <module> ValueError: unmarshallable object >>> cPickle.dumps(x) 'ccopy_reg\n_reconstructor\np1\n(c__builtin__\nobject\np2\ng2\nNtRp3\n.' That's a bit tongue-in-cheek, but it shows that the marshal serialization only handles a handful (I count 9) of built-in object types. What's "special" about pickle is it's the default recommended serialization method. Quoting http://docs.python.org/2/library/marshal.html http://docs.python.org/2/library/marshal.html: > "If you’re serializing and de-serializing Python objects, use the pickle module instead – the performance is comparable, version independence is guaranteed, and pickle supports a substantially wider range of objects than marshal."