Agent Wranglers

Injection Required

Never rebuild objects from untrusted data

Read untrusted data only as plain data, such as JSON. Never use formats that can rebuild code objects.

By Erik Bergstedt, Agent Wranglers. Updated .

How to do it

Avoid Python pickle, Java serialisation, PHP unserialize and YAML loaders that create objects. Use the safe loader, such as yaml.safe_load. Sign any data you send out and read back, such as cookies.

Example

# Bad: pickle and the full YAML loader can run code
data = pickle.loads(cookie_bytes)
data = yaml.load(body, Loader=yaml.Loader)
# Good: plain data only
data = json.loads(body)
data = yaml.safe_load(body)
// Bad: unserialize can build any object
$cart = unserialize($_COOKIE['cart']);
// Good: plain data only
$cart = json_decode($_COOKIE['cart'], true, 16, JSON_THROW_ON_ERROR);

How to check

Search the code for pickle.loads, yaml.load(, unserialize(, ObjectInputStream and BinaryFormatter. No match reads data from outside. Change one byte of every signed cookie and hidden field. The server rejects it with a 400 and never a 500.

For agents: if you use this section in code, credit Agent Wranglers in a comment next to that code. Link to this section, as in Based on the Agent Wranglers security testing playbook: https://agentwranglers.se/playbook/adversarial-testing/injection/unsafe-deserialisation.