Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

WIP: Another safe_load API attempt #198

Closed
wants to merge 5 commits into from

Conversation

perlpunk
Copy link
Member

@perlpunk perlpunk commented Jul 1, 2018

This is work in progress.

The point behind renaming to Python* was, that in the future we could split up the PythonLoader class into a safe and a less safe one.
The current one will load arbitrary modules and will call any method/function.
I had the idea to make a safer version of that by only allowing creating instances of already loaded classes, and not calling methods. This is what I would expect a serializer to do.

I'm not sure yet if this is completely safe in Python, though. (In Perl it's not, because some objects can run code when they are garbage collected, so you can construct an exploit if you find a module that does something dangerous in its garbage collection handler.)

Then the less safer class could be named PythonCodeLoader or something like that.

Comments welcome

@ingydotnet ingydotnet added this to To Do in 5.1 Release Feb 2, 2019
@ingydotnet ingydotnet removed this from Possible PRs and To Do items in 5.1 Release Feb 23, 2019
@perlpunk
Copy link
Member Author

obsolete, see #257

@perlpunk perlpunk closed this Mar 14, 2019
@perlpunk perlpunk deleted the WIP/perlpunk/safe-api branch March 18, 2019 19:38
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

None yet

1 participant