Re:Why Python Pickle is Inscecure
by yangyang on Wednesday September 09, 2009 @01:06PM
(#813522)
Why are they any more likely to be corrupted than any other file (including your python sources or .pyc files (which use another serialisation scheme, marshal))?
[ Parent
| on HN ]
I'm guessing because it's possible for the data to be corrupted in just the right way so as to construct some system-crashing (or critical-data corrupting) system() or eval() call. Though that's a pretty extreme paranoia.
As you state, the python files themselves could also be corrupted in such a manor and then run in the interpreter, or a compiled program could get corrupted in just the right way to execute 'rm -rf /' though it's not likely.