Pickle deserialization lab: Load a session token without pickle

pickle.loads can call arbitrary code through __reduce__ as it rebuilds objects. Parse the token with json.loads and remove every path that unpickles.

After parsing, enforce a strict schema: exactly user and role, both strings, an allowed role, no extra keys. A valid HMAC would authenticate the sender, not make a pickle safe to load.

import json

ALLOWED_ROLES = {"member", "admin", "viewer"}


def load_token(token):
    data = json.loads(token)  # never pickle; a non-JSON token raises here
    if not isinstance(data, dict):
        raise ValueError("token must be a JSON object")
    if set(data) != {"user", "role"}:
        raise ValueError("unexpected fields in token")
    if not isinstance(data["user"], str) or not isinstance(data["role"], str):
        raise ValueError("user and role must be strings")
    if data["role"] not in ALLOWED_ROLES:
        raise ValueError("unknown role")
    return {"user": data["user"], "role": data["role"]}

A JSON token such as {"user":"ana","role":"member"} loads to its two fields. A non-JSON token — a base64 pickle, or a pickle with a valid HMAC appended — raises at json.loads and is rejected, so nothing is unpickled and no __reduce__ runs. The schema rejects an unknown role, a non-string field and an extra field like is_admin, so a client cannot change its own role or smuggle in state. Signing does not help here: the signed-token case carries a correct HMAC, yet a loader that verifies the signature and then unpickles still executes the payload, because the signature attests to the sender, not to the safety of the content; only not unpickling untrusted bytes is safe.

Compare it with your own fix, then rerun the tests. The editor is not changed when you open this explanation.

The browser and the lab download run the same cases, including cases that catch common wrong fixes, such as comparing with one fixture value instead of the real rule. The download includes the complete test adapter and cryptographic fixtures.