contrib.dlint.dlint-equivalent.insecure-marshal-use

profile photo of returntocorpreturntocorp
Author
221
Download Count*
BSD 3-Clause "New" or "Revised" License
License

The Python 'marshal' module is not secure against maliciously constructed input

Run Locally

Run in CI

Semgrep CI docs

Defintion

Edit RuleView Source
Open in Playground 
rules:
  - id: insecure-marshal-use
    message: The Python 'marshal' module is not secure against maliciously
      constructed input
    languages:
      - python
    severity: WARNING
    metadata:
      source_rule_url: https://github.com/dlint-py/dlint/blob/master/docs/linters/DUO120.md
      category: security
      technology:
        - python
      references:
        - https://github.com/dlint-py/dlint/blob/master/docs/linters/DUO120.md
      owasp:
        - A08:2017 - Insecure Deserialization
        - A08:2021 - Software and Data Integrity Failures
      cwe:
        - "CWE-502: Deserialization of Untrusted Data"
      license: Commons Clause License Condition v1.0[LGPL-2.1-only]
    pattern: marshal.$ANYTHING