-
Notifications
You must be signed in to change notification settings - Fork 0
Open
Labels
Description
Pickle for serialization/deserialization is an example library that can be exploited by malicious actors to inject arbitrary code into pickled files, which can be unintentionally executed during deserialization.
Currently, the serialization/deserialization routines of ehrax are restricted on writing arrays of standard types, attributes of strings, etc.
That is not enough.
TODO:
- In testing, patch pickle functions and ensure pickle library is never invoked in serialization/deserialization.
- Implement a pytest fixture that monitors the use of pickle library. The fixture can be configured to
autouse=Truefor all the project tests.
Reactions are currently unavailable