I am writing a p2p project in python which involves sending serialised data between untrusted nodes. For convenience originally I used pickle but this is insecure and now I am converting my (sometimes very complex and highly nested) class objects into JSON for transmission and storage.
My question is whether it is safe to perform the following without risk of malicious code being run:
#class initially created:
class MyClass():
def __init__(self, cat, list_of_dogs, nested_list_of_zebras):
self.cat = cat
self.dogs = list_of_dogs
self.zebras = nested_list_of_zebras
p = MyClass(cat, dog_list, zebra_list)
json_obj = jsonpickle.encode(p)
#on the receiving end (or when bringing out of storage) we do
class ReCreateMyClass():
def __init__(self, python_obj)
self.cat = python_obj['cat']
self.dogs = python_obj['dogs']
self.zebras = python_obj['zebras']
def decode_js(python_obj):
return ReCreateMyClass(json.loads(python_obj))
# is this safe?
class_obj = decode_js(python_obj)
I am aware it is possible to automate this better (Is parsing a json naively into a Python class or struct secure?) but is there any risk of executing malicious code with JSON in this manner?
