hohn/codeql
1
0
Fork 0
mirror of https://github.com/github/codeql.git synced 2026-05-14 11:19:27 +02:00
Code Issues Packages Projects Releases Wiki Activity

Python: Clarify that deserialization following a schema is safe

Browse Source
This commit is contained in:
Owen Mansel-Chan
2026-05-08 14:05:55 +01:00
parent f2ea3b98d8
commit e2874ac252
1 changed files with 8 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files

8
python/ql/src/Security/CWE-502/UnsafeDeserialization.qhelp
View File

@@ -16,6 +16,14 @@ may have unforeseen effects, such as the execution of arbitrary code.
There are many different serialization frameworks. This query currently
supports Pickle, Marshal and Yaml.
</p>
<p>
Note that a deserialization method is only dangerous if it can instantiate
arbitrary classes. Serialization frameworks that use a schema to instantiate
only expected, predefined types are generally not tracked by this query. Such
frameworks are generally safe with respect to arbitrary-class-instantiation and
gadget-chain attacks when the schema is trusted and does not permit
user-controlled type resolution.
</p>
</overview>
<recommendation>