News for hackers. Stuff that matters.

A comment on Don't Pickle Your Data. Parent comment

Re:Don't Pickle Your Data by ademarre on Thursday August 11, 2022 @08:08PM (#32433366)
That quote supports my statement. Notice that the serialized object is the thing that was constructed by the attacker, not some user data that you serialized yourself.
[ Parent | on HN ]
Re:Don't Pickle Your Data by cratermoon on Thursday August 11, 2022 @10:41PM (#32434218)
No the input was not serialized, it was carefully crafted so that when it gets serialized and deserialized, it triggers the malicious payload.
[ Parent | on HN ]
Re:Don't Pickle Your Data by ademarre on Thursday August 11, 2022 @11:02PM (#32434325)
No. That is not how it works.

https://docs.python.org/3/library/pickle.html

https://blog.nelhage.com/2011/03/exploiting-pickle/ (referenced from https://cwe.mitre.org/data/definitions/502.html#REF-467)

[ Parent | on HN ]