Mailman 3 An official complaint regarding the marshal and pickle documentation - Python-ideas

5 Mar 2008

      I just checked the python site documentation on marshal and pickle and I
consider them to be irresponsibly and dangerously misleading.

For example.  Suppose Mercurial is implemented using pickle.load (I sure
hope it isn't -- is it?).

1) I send someone a "patch" for their software claiming it makes their
package run faster.

2) That person uses mercurial to "unpack" the patch and mercurial uses
pickle.load.

BAM!  That person's filesystem is GONE!  AND I'M NOT ASSUMING
THAT THERE IS ANY BUG IN MERCURIAL!

Now: suppose Mercurial is implemented using marshal: no such scenario is
possible
unless there is a security bug in mercurial where they explicitly execute
something.

RESOLVED: pickle should come with a large red label:

WARNING: LARK'S VOMIT --
NEVER USE PICKLE TO IMPLEMENT UNTRUSTED ARCHIVING OF ANY KIND.

It doesn't have one.

Marshal needs no such label: but it has one:

*Warning:* The marshal module is not intended to be secure against erroneous
or maliciously constructed data. Never unmarshal data received from an
untrusted or unauthenticated source.

This is bullshit.

Sorry, for the french and the caps, but this is REALLY IMPORTANT.

   -- Aaron Watters

An official complaint regarding the marshal and pickle documentation

Aaron Watters

tags

participants (12)