codeql/python/change-notes/2021-10-08-improve-pickle-d...

373 B

lgtm,codescanning

  • Improved modeling of decoding through pickle related functions (which can lead to code execution), resulting in additional sinks for the Deserializing untrusted input query (py/unsafe-deserialization). Now we fully support pickle.load, pickle.loads, pickle.Unpickler, marshal.load, marshal.loads, dill.load, dill.loads, shelve.open.