contrib.dlint.dlint-equivalent.insecure-pickle-use

rules:
  - id: insecure-pickle-use
    message: The Python 'pickle' module is not secure against maliciously
      constructed input
    languages:
      - python
    severity: WARNING
    metadata:
      source_rule_url: https://github.com/dlint-py/dlint/blob/master/docs/linters/DUO103.md
      category: security
      technology:
        - pickle
      references:
        - https://github.com/dlint-py/dlint/blob/master/docs/linters/DUO103.md
      owasp:
        - A08:2017 - Insecure Deserialization
        - A08:2021 - Software and Data Integrity Failures
      cwe:
        - "CWE-502: Deserialization of Untrusted Data"
      license: Commons Clause License Condition v1.0[LGPL-2.1-only]
    pattern-either:
      - pattern: pickle.loads(...)
      - pattern: pickle.load(...)
      - pattern: pickle.Unpickler(...)
      - pattern: cPickle.loads(...)
      - pattern: cPickle.load(...)
      - pattern: cPickle.Unpickler(...)