I seem to recall hearing in the past that unpickling in general was insecure for some reason. I'd like to allow less-priveleged users to upload their ZEXP files on their own and import them into their own Folders. Are there any security issues with ZEXP import? Thanks, -jordan. jbb@scryent.com
On 3/2/07, Jordan Baker <jbb@scryent.com> wrote:
I seem to recall hearing in the past that unpickling in general was insecure for some reason.
I'd like to allow less-priveleged users to upload their ZEXP files on their own and import them into their own Folders.
Are there any security issues with ZEXP import?
You heard correctly; pickles can contain arbitrary python classes and code and no security checks are done when importing ZEXP files. This means a user can completely control your server with a correctly crafted upload. -- Martijn Pieters
participants (2)
-
Jordan Baker -
Martijn Pieters