semgrep-rules icon indicating copy to clipboard operation
semgrep-rules copied to clipboard

[Security] Added edge cases for tainted pickle deserialization

Open theinfosecguy opened this issue 3 months ago • 0 comments

  • Added pattern-not conditions to exclude safe usage patterns and minimize false positives.
  • Added new test cases to cover a wider range of scenarios, including both vulnerable and safe usage patterns.

The patterns like pickle.load(pickle.dumps(...)) are added to pattern-not to avoid false positives in situations where the data being deserialized is explicitly serialized using pickle.dumps() within the same codebase.

theinfosecguy avatar Apr 16 '24 07:04 theinfosecguy