Openfix: handle deserialization in user input#42
src/api/views.py
21 data = request.body
- obj = pickle.loads(data)
+ obj = json.loads(data)
!
code-pathfinder•HIGH
python/deserialization: unsafe pickle.loads() call — arbitrary code execution risk1 high
3 passed
code-pathfinder
ProductGitHub ActionsPull RequestSASTCI/CDGitHub Code ScanningCodeQL AlternativeDevSecOpsSARIF
Automated GitHub PR Security Comments & Inline SAST Findings with Code Pathfinder
Code Pathfinder's GitHub Action now posts security scan results as PR summary comments and inline review annotations. Browse 100+ open-source SAST rules at codepathfinder.dev/registry.
Shivasurya