Skip to content

Ensure no pickle is used internally by pytables #9

@A-Alaa

Description

@A-Alaa

Pickle for serialization/deserialization is an example library that can be exploited by malicious actors to inject arbitrary code into pickled files, which can be unintentionally executed during deserialization.
Currently, the serialization/deserialization routines of ehrax are restricted on writing arrays of standard types, attributes of strings, etc.
That is not enough.
TODO:

  • In testing, patch pickle functions and ensure pickle library is never invoked in serialization/deserialization.
  • Implement a pytest fixture that monitors the use of pickle library. The fixture can be configured to autouse=True for all the project tests.

Metadata

Metadata

Assignees

Labels

Type

Projects

No projects

Milestone

No milestone

Relationships

None yet

Development

No branches or pull requests

Issue actions