Deserializing objects is security-sensitive. For example, it has led in the past to the following vulnerabilities:

* https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-4406[CVE-2012-4406]: OpenStack Object Storage: arbitrary code execution via a crafted pickle object
* https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-2809[CVE-2017-2809]: Ansible Vault: arbitrary code execution via a crafted yaml
* http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-1000058[CVE-2018-1000058]: OpenStack Object Storage: arbitrary code execution via a crafted yaml


Object deserialization from an untrusted source can lead to unexpected code execution. Deserialization takes a stream of bits and turns it into an object. If the stream contains the type of object you expect, all is well. But if you're deserializing untrusted input, and an attacker has inserted some other type of object, you're in trouble. Why? There are a few different attack scenarios, but a widely-documented one goes like this: untrusted YAML content is deserialized using the unsafe ``++load++`` function form PyYAML library. ``++PyYAML.load++`` function could be easily exploited to call any Python function including system command.

== Ask Yourself Whether

* an attacker could have tampered with the source provided to the deserialization function
* you are using an unsafe deserialization function

You are at risk if you answered yes to any of those questions.

== Recommended Secure Coding Practices

To prevent insecure deserialization, it is recommended to:

* Use safe libraries that do not allow code execution at deserialization. 
* Not communicate with the outside world using serialized objects
* Limit access to the serialized source
** if it is a file, restrict the access to it.
** if it comes from the network, restrict who has access to the process, such as with a Firewall or by authenticating the sender first.

include::../see.adoc[]

ifdef::env-github,rspecator-view[]

'''
== Implementation Specification
(visible only on this page)

include::../message.adoc[]

'''
== Comments And Links
(visible only on this page)

include::../comments-and-links.adoc[]

endif::env-github,rspecator-view[]
