hohn/codeql
1
0
Fork 0
mirror of https://github.com/github/codeql.git synced 2026-05-14 11:19:27 +02:00
Code Issues Packages Projects Releases Wiki Activity

Python: remove doubles spaces from qhelp

Browse Source
This commit is contained in:
Owen Mansel-Chan
2026-05-08 14:06:48 +01:00
parent ed9477aac9
commit 93e05db394
1 changed files with 4 additions and 4 deletions
Download Patch File Download Diff File Expand all files Collapse all files

8
python/ql/src/Security/CWE-502/UnsafeDeserialization.qhelp
View File

@@ -5,15 +5,15 @@
<p>
Deserializing untrusted data using any deserialization framework that
allows the construction of arbitrary serializable objects is easily exploitable
and in many cases allows an attacker to execute arbitrary code. Even before a
and in many cases allows an attacker to execute arbitrary code. Even before a
deserialized object is returned to the caller of a deserialization method a lot
of code may have been executed, including static initializers, constructors,
and finalizers. Automatic deserialization of fields means that an attacker may
and finalizers. Automatic deserialization of fields means that an attacker may
craft a nested combination of objects on which the executed initialization code
may have unforeseen effects, such as the execution of arbitrary code.
</p>
<p>
There are many different serialization frameworks. This query currently
There are many different serialization frameworks. This query currently
supports Pickle, Marshal and Yaml.
</p>
<p>
@@ -28,7 +28,7 @@ user-controlled type resolution.
<recommendation>
<p>
Avoid deserialization of untrusted data if at all possible. If the
Avoid deserialization of untrusted data if at all possible. If the
architecture permits it then use other formats instead of serialized objects,
for example JSON.
</p>