Do Pickle and Dill have similar levels of risk of containing malicious script?

前端 未结 3 1571
伪装坚强ぢ
伪装坚强ぢ 2020-12-21 23:57

Dill is obviously a very useful module, and it seems as long as you manage the files carefully it is relatively safe. But I was put off by the statement:

3条回答
  •  甜味超标
    2020-12-22 00:07

    Dill is built on top of pickle, and the warnings apply just as much to pickle as they do to dill.

    Pickle uses a stack language to effectively execute arbitrary Python code. An attacker can sneak in instructions to open up a backport to your machine, for example. Don't ever use pickled data from untrusted sources.

    The documentation includes an explicit warning:

    Warning: The pickle module is not secure against erroneous or maliciously constructed data. Never unpickle data received from an untrusted or unauthenticated source.

提交回复
热议问题