Skip to content

Commit 055e9c9

Browse files
authored
Add warning about unpickling untrusted data
1 parent 5746e7f commit 055e9c9

File tree

1 file changed

+3
-0
lines changed

1 file changed

+3
-0
lines changed

README.md

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -479,6 +479,9 @@ After running `python main.py --package Tap`, the file `args.json` will contain:
479479
Note: More complex types will be encoded in JSON as a pickle string.
480480

481481
#### Load
482+
> :exclamation: :warning:<br/>
483+
> Never call `args.load('args.json')` on untrusted files. Argument loading uses the `pickle` module to decode complex types automatically. Unpickling of untrusted data is a security risk and can lead to arbitrary code execution. See [the warning in the pickle docs](https://docs.python.org/3/library/pickle.html)<br/>
484+
> :exclamation: :warning:
482485
483486
Arguments can be loaded from a JSON file rather than parsed from the command line.
484487

0 commit comments

Comments
 (0)