You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Faust latest version (1.10.4) still makes use of the pickle.loads function, even if it is marked in Python documentation as "not secure".
This is reported by tools such as NexusIQ as a major vulnerability, with potentially a no go for production in sensitive projects.
Since the "raw_pickle" serializer is rather trivial, I propose to remove it from the code and move it into the documentation. People who really need it will be able easily to add it in their own project (at their own risk).
The text was updated successfully, but these errors were encountered:
olivier-heurtier
changed the title
Faust should not used the unsecure pickle.loads
Faust should not use the unsecure pickle.loads
Oct 12, 2021
Faust latest version (1.10.4) still makes use of the pickle.loads function, even if it is marked in Python documentation as "not secure".
This is reported by tools such as NexusIQ as a major vulnerability, with potentially a no go for production in sensitive projects.
Since the "raw_pickle" serializer is rather trivial, I propose to remove it from the code and move it into the documentation. People who really need it will be able easily to add it in their own project (at their own risk).
The text was updated successfully, but these errors were encountered: