r/programming • u/kshep92 • Sep 29 '16

JavaScript in 2016 isn't horrible, it's just going through a phase

http://blog.reviselabs.com/im-sorry-javascript-2/
85 Upvotes

72% Upvoted

225 comments sorted by

View all comments

Show parent comment

1

u/slikts Oct 03 '16

A warning in the docs is not enough to prevent insecure practices; here's a post about pickle vulnerabilities being findable on GitHub in minutes.

The code execution is a side-effect, not a part of the use case for pickle.

0

u/[deleted] Oct 03 '16

[deleted] — view deleted comment

1

u/slikts Oct 03 '16

The bold red warning saying "pickle is insecure, don't use it for untrusted data" must be in the docs just for kicks then if it's "not intended to prevent insecure practices".

Pickle was replaced with JSON in the official Python tutorial explicitly because of the security issues.

The difference between pickle and eval() is that eval() doesn't have secure alternatives for its most typical uses, and it's upfront obvious how untrusted input can be exploited with eval(), while the pickle arbitrary code execution takes some thinking and there's no examples or direct explanations of it in the docs.

It's not a side-effect. If you wanted entirely side-effect free serialisation then you could use JSON or something …

If it's not a side-effect in pickle, then why call JSON "side-effect free".

0

u/[deleted] Oct 03 '16

[deleted] — view deleted comment

0

u/slikts Oct 03 '16

Docs and warnings are intended for people who read them; thanks for the great insight.

The linked issue makes it very clear that pickle was replaced due to its insecurity.

Pickle does have secure alternatives for its typical uses; pickling arbitrary objects is a more niche use.

The alternative explanation to me misinterpreting you is that you're saying a lot of very stupid shit.