From da5d2339de1774b2619d25d5e57ab44553c6af45 Mon Sep 17 00:00:00 2001
From: Devin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com>
Date: Thu, 26 Mar 2026 09:12:24 +0000
Subject: [PATCH] fix: resolve CodeQL alert #35 - Deserialization of
 user-controlled data

---
 vulnerable_deserialization.py | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/vulnerable_deserialization.py b/vulnerable_deserialization.py
index 4d443d1..ef8e629 100644
--- a/vulnerable_deserialization.py
+++ b/vulnerable_deserialization.py
@@ -17,7 +17,8 @@ def load_data():
 def restore_session():
     session_data = request.form.get('session')
     
-    session = pickle.loads(session_data.encode())
+    import json as _json
+    session = _json.loads(session_data)
     
     return f"Session restored: {session}"