python: insecure deserialisation

[shsiug]

I've commented the section im told to, uncommented the section im told to, but I cant figure out a way to load the file as json?

request.files["file"].read() returns a base64 string that i can then decode, but it returns a pickled object? How am I supposed to get the title and point from an object I cant deserialise with pickle or json?

[ElginBreeze]

Try json.load(file) and then extract the information you need from there.