Unsafe deserialization

Keep untrusted values out of executable syntax

Choose a safe interface for each interpreter and bound the work performed by parsers and converters.

Development · Developers

Parse bounded JSON and XML into an explicit application schema

Separate parser capabilities from schema rules, reject ambiguous and coercible inputs, and implement the boundary in a complete Python project.

Development · Developers, AppSec engineers

Treat model releases as executable supply-chain inputs

Verify provenance, constrain loading and preserve the relationship between model weights, configuration and runtime dependencies.

Development, Release · Developers, AppSec engineers, Platform engineers and SREs

SQL injection lab: Separate SQL structure from data with sqlite3

A product search builds its SQL by formatting the shopping category and search term straight into the query string, so a crafted term can read other tables or return every row. Repair it to use sqlite3 parameters, while keeping the legitimate search working.

OS command injection lab: Run git without a shell

A repository browser pastes request values into a git command line for the shell, so a semicolon starts a second command and a leading dash becomes a git option. Run git directly, with each value as one argument.

SSTI lab: Render a welcome banner without template injection

A welcome banner is built by concatenating the user’s display name into a Jinja template string, so a crafted name is evaluated as a template: it runs expressions, bypasses autoescaping and reads the render context. Repair render_welcome so the name is data, not template source.

XXE lab: Parse an uploaded invoice without resolving external entities

An invoice importer parses uploaded XML with a parser that resolves external entities, so a crafted DOCTYPE reads a local file into the response (XXE). Repair parse_invoice so the parser never resolves external entities, loads no DTD and makes no network request.

Pickle deserialization lab: Load a session token without pickle

A session loader parses JSON but falls back to pickle for “legacy” tokens, so a crafted pickle runs code when it is loaded. Repair load_token to parse JSON only and validate it against a fixed schema, and leave no path that unpickles untrusted bytes.

Insecure deserialization

Insecure deserialization happens when a service rebuilds objects from bytes it received from a client, letting the input choose which types are created and what runs while they are built.