(BAN-B301) Audit required: Use of `pickle` module

itssoap / Reverse-proxy

Over-engineered Reverse Proxy using FastAPI

5 stars 0 forks source link

(BAN-B301) Audit required: Use of `pickle` module #3

Open itssoap opened 1 year ago

itssoap commented 1 year ago

Description

The pickle module is not secure against erroneous or maliciously constructed data. Never unpickle data received from an untrusted or unauthenticated source.

Occurrences

There is 1 occurrence of this issue in the repository.

See all occurrences on DeepSource → deepsource.io/gh/itssoap/Reverse-proxy/issue/BAN-B301/occurrences/

itssoap commented 1 year ago

This issue will require a separate rewrite of pickles module utilities to restrict arbitrary class/code execution and make it secure for my use-case.