Rules / Python
SHIELD-PY-016
Insecure deserialization with marshal
What it detects
marshal.loads() on untrusted data can cause crashes or arbitrary code execution.
How to fix
Do not deserialize untrusted data with marshal. Use JSON for data interchange.
Vulnerable — Shield flags thiscache.py
import marshal
def load_cached(blob: bytes):
return marshal.loads(blob)
Fixed — scans cleancache.py
import json
def load_cached(blob: bytes):
return json.loads(blob)
Both snippets are verified against the shipped scanner: the vulnerable one triggers SHIELD-PY-016, the fixed one does not.