On 12/07/20 5:31 am, Wes Turner wrote:
Is there already a way to load data and not code *with pickle*?
As far as I know, pickle has never been able to load code objects. The security problems come from the fact that by default a pickle is able to *call* any module-level callable object that it has access to, with arbitrary data as arguments. Since this includes eval() and exec(), it can effectively run arbitrary code. The set of callables that can be considered "safe" depends on the application, so there can't really be a generic "safe" option. If that were possible, it would no doubt already exist and be the default. -- Greg _______________________________________________ Python-ideas mailing list -- python-ideas@python.org To unsubscribe send an email to python-ideas-le...@python.org https://mail.python.org/mailman3/lists/python-ideas.python.org/ Message archived at https://mail.python.org/archives/list/python-ideas@python.org/message/R33NHI7ZMISYLSXH4SAMY7BOGVTRKQUG/ Code of Conduct: http://python.org/psf/codeofconduct/
