add jsonpickle deserialization blacklist (#707)

* add jsonpickle deserialization blacklist add jsonpickle deserialization blacklist * Update calls.py * Update test_functional.py * Create jsonpickle.py Co-authored-by: Eric Brown <ericwb@users.noreply.github.com>
PyCQA · Jul 7, 2022 · 9832461 · 9832461
1 parent 5aae21e
commit 9832461
Show file tree

Hide file tree

Showing 3 changed files with 24 additions and 0 deletions.
diff --git a/bandit/blacklists/calls.py b/bandit/blacklists/calls.py
@@ -32,6 +32,9 @@
 |      |                     | - dill.Unpickler                   |           |
 |      |                     | - shelve.open                      |           |
 |      |                     | - shelve.DbfilenameShelf           |           |
+|      |                     | - jsonpickle.decode                |           |
+|      |                     | - jsonpickle.unpickler.decode      |           |
+|      |                     | - jsonpickle.unpickler.Unpickler   |           |
 +------+---------------------+------------------------------------+-----------+
 
 B302: marshal
@@ -352,6 +355,9 @@ def gen_blacklist():
                 "dill.Unpickler",
                 "shelve.open",
                 "shelve.DbfilenameShelf",
+                "jsonpickle.decode",
+                "jsonpickle.unpickler.decode",
+                "jsonpickle.unpickler.Unpickler",
             ],
             "Pickle and modules that wrap it can be unsafe when used to "
             "deserialize untrusted data, possible security issue.",

diff --git a/examples/jsonpickle.py b/examples/jsonpickle.py
@@ -0,0 +1,10 @@
+import jsonpickle
+
+
+pick = jsonpickle.encode({'a': 'b', 'c': 'd'})
+
+print(jsonpickle.decode(pick))
+
+print(jsonpickle.unpickler.decode(pick))
+
+print(jsonpickle.unpickler.Unpickler().restore(pick))
diff --git a/tests/functional/test_functional.py b/tests/functional/test_functional.py
@@ -369,6 +369,14 @@ def test_shelve(self):
         }
         self.check_example("shelve_open.py", expect)
 
+    def test_jsonpickle(self):
+        """Test for the `jsonpickle` module."""
+        expect = {
+            "SEVERITY": {"UNDEFINED": 0, "LOW": 0, "MEDIUM": 3, "HIGH": 0},
+            "CONFIDENCE": {"UNDEFINED": 0, "LOW": 0, "MEDIUM": 0, "HIGH": 3},
+        }
+        self.check_example("jsonpickle.py", expect)
+
     def test_popen_wrappers(self):
         """Test the `popen2` and `commands` modules."""
         expect = {