Re:Why Python Pickle is Inscecure
by cool-RR on Wednesday September 09, 2009 @12:35PM
(#813441)
Makes me fear that data corruption in my pickles will crash the system. Maybe someone should implement an interface to 'pickle' that maintains a hash of the string.
[ Parent
| on HN ]
Why are they any more likely to be corrupted than any other file (including your python sources or .pyc files (which use another serialisation scheme, marshal))?
I'm guessing because it's possible for the data to be corrupted in just the right way so as to construct some system-crashing (or critical-data corrupting) system() or eval() call. Though that's a pretty extreme paranoia.
As you state, the python files themselves could also be corrupted in such a manor and then run in the interpreter, or a compiled program could get corrupted in just the right way to execute 'rm -rf /' though it's not likely.