Repository navigation
Deprecate usage of pickle #19745
Description
Related issues, PRs or discussions
What is the current state of the codebase?
NVDA uses pickle as a data persistance format.
Why are changes required?
Pickle is an inherently unsafe format.
What technical changes are required?
As well as removing current usages of pickle, we should add a lint rule that flags future uses of pickle, as was done for winsound.playsound in #17543.
Are the proposed technical changes API breaking?
No.
Are there potential risks or issues with the proposed implementation?
No.
Activity
Harden protocol against pickle RCE with a restricted unpickler (#63)