Deserialisation of untrusted data: pickle and Java serialization

What it is

A pickle stream is a small program for a stack machine; its opcodes can import any module and call any callable with arguments, which is how pickle.loads reconstructs objects. The Python documentation (cited) warns that the module is not secure, that malicious pickle data can execute arbitrary code during unpickling, and that data from an untrusted source must never be unpickled. Its "Restricting Globals" section shows the mitigation for the cases that remain: subclass Unpickler, override find_class and allow only an explicit list of module and name pairs. Java's ObjectInputStream has the same shape: the stream names classes, the runtime instantiates them and runs their readObject, readResolve and readExternal logic, and chains of ordinary library classes ("gadget chains") turn that into command execution. Oracle's documentation (cited) describes serialization filtering as the mechanism against this: a jdk.serialFilter pattern, set for one application as a system property or JVM-wide as a security property, that allows or rejects class names and bounds array size, graph depth, references and stream bytes; custom filters implement the ObjectInputFilter API.

Why it matters

The formats are convenient for caches, job queues, session stores and RPC, so they end up reading data that crossed a trust boundary: a cookie, a queue another tenant can write to, a file upload. The attacker needs no bug in your code, only your deserialiser and the classes on your classpath or import path.

How to apply

• Prefer data-only formats (JSON, Protocol Buffers, MessagePack) with schema validation for anything that crosses a boundary; reserve pickle and Java serialization for data produced and consumed by the same trusted process.
• If a pickle must be accepted, sign it with HMAC under a server-side key and verify before loading, as the pickle documentation suggests, and still restrict globals.
• In Java, set jdk.serialFilter with an allowlist and resource limits (maxdepth, maxarray, maxrefs, maxbytes), or override resolveClass as the OWASP cheat sheet (cited) shows, and give domain classes that must be Serializable a readObject that throws.
• Grep for pickle.load, ObjectInputStream, readObject, XMLDecoder and XStream.fromXML in code review; the cheat sheet lists the Java entry points.
• On the wire, Java streams start with the bytes AC ED 00 05 (rO0 in Base64); recognising them in traffic or storage is a quick audit.

Pitfalls

A denylist of known gadget classes; new chains appear regularly. Assuming a framework's "safe mode" flag is set in production. Loading machine-learning model files from the internet without checking whether the format is a pickle stream.