Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Add codemod harden-pickle-load #332

Merged
merged 2 commits into from
Mar 6, 2024
Merged

Add codemod harden-pickle-load #332

merged 2 commits into from
Mar 6, 2024

Conversation

drdavella
Copy link
Member

@drdavella drdavella commented Mar 5, 2024 •
edited
Loading

Overview

Add code to harden calls to pickle.load

Description

  • @matt- brought the fickling library to my attention the other day
  • This gives us an opportunity to add hardening to pickle.load calls
  • Ideally developers should avoid pickle altogether but this can make code safer in the meantime
  • This should help us remediate findings from other tools as well

@drdavella drdavella force-pushed the harden-pickle-load branch from d38b12b to 0a4373b Compare March 5, 2024 20:30
@pixeebot pixeebot bot mentioned this pull request Mar 5, 2024
Merged
@drdavella drdavella force-pushed the harden-pickle-load branch from 0a4373b to fa19a15 Compare March 5, 2024 20:36
@drdavella drdavella marked this pull request as ready for review March 5, 2024 20:40
@drdavella drdavella force-pushed the harden-pickle-load branch from fa19a15 to 88ce86f Compare March 5, 2024 20:48
@drdavella drdavella enabled auto-merge March 6, 2024 14:02
@drdavella drdavella force-pushed the harden-pickle-load branch from 88ce86f to 3d88d85 Compare March 6, 2024 14:03
@sonarqubecloud SonarQubeCloud
Copy link

sonarqubecloud bot commented Mar 6, 2024

Quality Gate Passed Quality Gate passed

Issues
1 New issue
0 Accepted issues

Measures
0 Security Hotspots
No data about Coverage
0.0% Duplication on New Code

See analysis details on SonarCloud

@drdavella drdavella added this pull request to the merge queue Mar 6, 2024
Merged via the queue into main with commit 018ce52 Mar 6, 2024
11 checks passed
@drdavella drdavella deleted the harden-pickle-load branch March 6, 2024 15:08
@drdavella drdavella mentioned this pull request Mar 7, 2024
Closed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Reviewers

@clavedeluna clavedeluna clavedeluna approved these changes

@andrecsilva andrecsilva andrecsilva approved these changes

Assignees
No one assigned
Labels
None yet
Projects
None yet
Milestone
No milestone
Development

Successfully merging this pull request may close these issues.
3 participants
@drdavella @andrecsilva @clavedeluna