Code Smell 215 - Deserializing Object Vulnerability
Metaprogramming is always a problem

I’m a senior software engineer loving clean code, and declarative designs. S.O.L.I.D. and agile methodologies fan.
Search for a command to run...
Metaprogramming is always a problem

I’m a senior software engineer loving clean code, and declarative designs. S.O.L.I.D. and agile methodologies fan.
No comments yet. Be the first to comment.
In this series, we will see several symptoms and situations that make us doubt the quality of our developments. We will present possible solutions. Most are just clues. They are no hard rules.
Different stages need different brains.

One Second Brain doesn't scale past one skull.

Style errors double when nobody enforces them.

Know who speaks before the skill runs TL;DR: Always define a clear role at the top of every skill file so you know whose perspective drives the execution. Common Mistake ❌ You write a skill full of

Everyone is talking about Loop Engineering. Apparently, you don't need to program anymore. TL;DR: Loop Engineering is the hottest AI workflow pattern of 2026. But it hides a dirty secret. The Tweet

TL;DR: Don't allow remote code execution
Validate and sanitize input
Avoid executing code. Input only data
Apply sandboxing or isolation
Deserializing objects from an untrusted source is indeed a security-sensitive operation.
Suppose you have a web application that accepts serialized objects as input from user-submitted data, such as in an API endpoint or a file upload feature.
The application deserializes these objects to reconstruct them into usable objects within the system.
If an attacker submits maliciously crafted serialized data to exploit vulnerabilities in the deserialization process.
They might manipulate the serialized data to execute arbitrary code, escalate privileges, or perform unauthorized actions within the application or the underlying system.
This type of attack is commonly known as "deserialization attacks" or "serialization vulnerabilities."
import pickle # Python's serialization module
def process_serialized_data(serialized_data):
try:
obj = pickle.loads(serialized_data)
# Deserialize the object
# Process the deserialized object
# ...
# User-submitted serialized data
user_data = b"\x80\x04\x95\x13\x00\x00\x00\x00\x00\x00\x00\x8c\x08os\nsystem\n\x8c\x06uptime\n\x86\x94."
# This code executes os.system("uptime")
process_serialized_data(user_data)
import json
def process_serialized_data(serialized_data):
try:
obj = json.loads(serialized_data)
# Deserialize the JSON object
# Does not execute code
# ...
user_data = '{"key": "value"}'
process_serialized_data(user_data)
[X] Semi-Automatic
Several linters warn about deserialization points.
Metaprogramming opens doors to abusers.
Code Smells are my opinion.
Photo by Towfiqu barbhuiya on Unsplash
Whenever possible, steal code.
Tom Duff
This article is part of the CodeSmell Series.