Skip to content

fix : replace unsafe pickle.load with json in Word-Building data.py #1841

Description

@tmdeveloper007

Summary of What Needs to be Done

Replace all pickle.load() and pickle.dump() calls in games/Word-Building/data.py with JSON-based serialization. pickle is unsafe because it can execute arbitrary Python code when deserializing untrusted data, which is a security risk if the words.bat data file is ever tampered with.

Changes that Need to be Made

  • Replace import pickle with import json
  • Replace pickle.load(file) with json.load(file)
  • Replace pickle.dump(words, file) with json.dump(words, file, ensure_ascii=False)
  • Rename words.bat to words.json to reflect the new format
  • Update the WORDS_FILE path to use .json extension

Impact that it would Provide

  • Eliminates arbitrary code execution risk from pickle deserialization
  • Uses a standard, safe, cross-language serialization format
  • Improves maintainability (JSON is human-readable for debugging)

Note: Please assign this issue to the tmdeveloper007 account.

Metadata

Metadata

Assignees

No one assigned

    Labels

    No labels
    No labels

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions