Fix/insecure deserialization #31

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Open

Msfv3n0m wants to merge 4 commits into tae898:main from Msfv3n0m:fix/insecure-deserialization

Msfv3n0m commented Jul 17, 2025

User input was being insecurely deserialized via the jsonpickle library

Changes:

removed jsonpickle dependency
added input validation and error handling

Testing:

Manually tested by submitting a serialized python object via JSON

Msfv3n0m added 4 commits

July 17, 2025 09:37


          remove jsonpickle dependency in app.py

b20d791


          remove jsonpickle dependency in client.py

a1e03d4


          rm jsonpickle from reqs.txt files

bb3fc06


          validate request json input

e506591

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet