禁用 unpickling,但允许其他一切

问题描述 投票:0回答:0

我正在使用第 3 方图书馆,除非另有指示,否则不幸倾向于使用泡菜。

我知道加载 pickle 可能允许任意代码执行,所以我想知道库何时尝试执行此操作。

我能做些什么来阻止它解酸?

这是我的尝试:

class Unpickler(pickle.Unpickler):
    def load(self, *args, **kwargs):
        raise RuntimeError("Unpickling is disabled in this script.")
    
def load(self, *args, **kwargs):
    raise RuntimeError("Unpickling is disabled in this script.")
    
def loads(self, *args, **kwargs):
    raise RuntimeError("Unpickling is disabled in this script.")
    
pickle.Unpickler = Unpickler
pickle.load = load
pickle.loads = loads

import pickle_fanatic_library

这足以禁止任意代码执行吗?

(我想尽可能多地保留

pickle
的功能)

python pickle
© www.soinside.com 2019 - 2024. All rights reserved.