Question

I recently came across the security problems of the Python pickle and cPickle modules.
Obviously, there are no real security measures implemented in pickle unless you overwrite
the find_class method as a basic modification to get a bit more security. But I often
heard that JSON is more secure.

Can anyone elaborate a bit on this?`Why is JSON more secure than pickle?

Thanks a lot!
Mark

Answer 1

json is more secure because it’s fundamentally more limited. The only python types that a json document can encode are unicode, int, float, NoneType, bool, list and dict. these are marshaled/unmarshalled in a basically trivial fashion that isn’t vulnerable to code injection attacks.