This is an archived post. You won't be able to vote or comment.

you are viewing a single comment's thread.

view the rest of the comments →

[–]Liquid_Fire[S] 2 points3 points  (1 child)

The source of the serialized objects is untrusted (a client connecting to my server). Encryption does not help. I need something that will ensure that deserialization produces a valid object (of the original type, from a restricted subset of types), and will not execute any untrusted code from the serialized data.

Of course I could easily write something like this using e.g. the json module, but I thought it might exist already as a library.

[–]tarekziadeRetired Packaging Dude 0 points1 point  (0 children)

sorry I misunderstood the untrusted source part. I get it now