Insecure deserialization: pickle, Java serialization and YAML

Vulnerable

import base64, pickle

def load_session(cookie: str):
    return pickle.loads(base64.b64decode(cookie))

# A crafted payload's __reduce__ runs os.system during loads(); nothing
# in the application ever sees the object.

Secure

import base64, hmac, hashlib, json, os

KEY = os.environb[b"SESSION_KEY"]

def load_session(cookie: str) -> dict:
    raw = base64.b64decode(cookie)
    body, tag = raw[:-32], raw[-32:]
    expected = hmac.new(KEY, body, hashlib.sha256).digest()
    if not hmac.compare_digest(tag, expected):
        raise ValueError("bad session signature")

    data = json.loads(body)              # JSON cannot construct objects
    return {
        "user_id": int(data["user_id"]),  # map fields explicitly
        "roles": [str(r) for r in data.get("roles", [])],
    }

Vulnerable

import yaml

config = yaml.load(request.data)   # full loader: !!python/object/apply:os.system

Secure

import yaml

config = yaml.safe_load(request.data)
if not isinstance(config, dict):
    raise ValueError("expected a mapping")

Vulnerable

try (ObjectInputStream ois = new ObjectInputStream(request.getInputStream())) {
    Order order = (Order) ois.readObject();   // gadget chain runs before the cast
}

Secure

// Preferred: change the format.
ObjectMapper mapper = new ObjectMapper();
mapper.disable(DeserializationFeature.FAIL_ON_UNKNOWN_PROPERTIES);
// Default typing must stay OFF — enabling it reintroduces the gadget problem in JSON.
Order order = mapper.readValue(request.getInputStream(), Order.class);

// If the wire format is fixed, filter the classes (Java 9+ / 8u121+):
ObjectInputFilter filter = ObjectInputFilter.Config.createFilter(
    "com.example.dto.*;java.lang.String;java.util.ArrayList;!*");
try (ObjectInputStream ois = new ObjectInputStream(in)) {
    ois.setObjectInputFilter(filter);
    Order order = (Order) ois.readObject();
}