search

pallets-eco / flask-session

Server side session extension for Flask
https://flask-session.readthedocs.io
BSD 3-Clause "New" or "Revised" License
507 stars 238 forks source link

Don't use pickle for SqlAlchemy backend #29

Closed xSke closed 8 months ago

xSke commented 8 years ago

Using pickle is a major security flaw, and can be used for remote code execution or opening a shell.

I understand the pickled data doesn't get read from the client, but it's still a bad idea to store it in the database, since if the database server gets compromised, every single app server is compromised as well.

For more information, see: https://www.cs.uic.edu/~s/musings/pickle.html

mcrowson commented 7 years ago

This issue was moved to mcrowson/flask-session#7

Lxstr commented 8 months ago

Pickle to be deprecated from 0.7.0 and removed in 1.0.0