So they were pickeling EXECUTABLE objects in the session and storing it in the u... | Hacker News

Hacker Newsnew | past | comments | ask | show | jobs | submit

DrJones1098 on Aug 24, 2018 | parent | context | favorite | on: Remote Code Execution on a Facebook server

So they were pickeling EXECUTABLE objects in the session and storing it in the users browser cookie? Interesting. Nice find.

ebikelaw on Aug 25, 2018 [–]

There is no such thing as non-executable pickle. Pickle is not safe and must not be used for anything, ever.

DrJones1098 on Aug 25, 2018 | [–]

Wow. I have to look into it. That sounds wildy unsafe

Consider applying for YC's Winter 2027 batch! Applications are open till November 2.
Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact