Intermediate LevelPython
Why is the pickle module vulnerable to Remote Code Execution (RCE) and when is it acceptable to use?
❓ Interview Prompt: Explain `pickle` serialization, `__reduce__()` dunder method, Remote Code Execution (RCE) security risks, and safe alternatives (JSON, Protobuf).
The 'pickle' module serializes arbitrary Python objects into binary streams:
CRITICAL SECURITY RISK (RCE):
'pickle' is NOT SECURE against untrusted data! Deserializing untrusted pickle payloads invokes object '__reduce__()' methods, allowing attackers to execute arbitrary OS shell commands (Remote Code Execution):
•
Rule: Never 'pickle.loads()' data from untrusted network sources! Use JSON or Protocol Buffers instead.
Code Implementation Example
python
import pickle
# Safe usage on local trusted data ONLY:
data = {'key': 'value', 'numbers': [1, 2, 3]}
serialized = pickle.dumps(data)
restored = pickle.loads(serialized)
print(restored)💡Serializing objects safely with pickle on trusted local data.
🎯 Interview Key Takeaway
Never unpickle data received from untrusted network sources due to Remote Code Execution vulnerabilities.
#pickle#RCE#Security#Serialization#Intermediate
Back to all Python Questions→