Comment on A Celery-like Python Task Queue in 55 Lines of CodeparentComments−jknuppOP12yPickle (or any use of eval) is a security risk only if you're using it in the context of untrusted code. Basically any distributed task queue is going to have that risk if it can execute arbitrary code.−bagels12yI thought the risk was if the data came from an untrusted source, as it might contain code?−jonesetc12yI think shooting it over the network is considered untrusted. Man in the middle becomes a problem.
Comments
Pickle (or any use of eval) is a security risk only if you're using it in the context of untrusted code. Basically any distributed task queue is going to have that risk if it can execute arbitrary code.
I thought the risk was if the data came from an untrusted source, as it might contain code?
I think shooting it over the network is considered untrusted. Man in the middle becomes a problem.