Summary of What Needs to be Done
Replace all pickle.load() and pickle.dump() calls in games/Word-Building/data.py with JSON-based serialization. pickle is unsafe because it can execute arbitrary Python code when deserializing untrusted data, which is a security risk if the words.bat data file is ever tampered with.
Changes that Need to be Made
- Replace
import pickle with import json
- Replace
pickle.load(file) with json.load(file)
- Replace
pickle.dump(words, file) with json.dump(words, file, ensure_ascii=False)
- Rename
words.bat to words.json to reflect the new format
- Update the
WORDS_FILE path to use .json extension
Impact that it would Provide
- Eliminates arbitrary code execution risk from pickle deserialization
- Uses a standard, safe, cross-language serialization format
- Improves maintainability (JSON is human-readable for debugging)
Note: Please assign this issue to the tmdeveloper007 account.
Summary of What Needs to be Done
Replace all
pickle.load()andpickle.dump()calls ingames/Word-Building/data.pywith JSON-based serialization.pickleis unsafe because it can execute arbitrary Python code when deserializing untrusted data, which is a security risk if thewords.batdata file is ever tampered with.Changes that Need to be Made
import picklewithimport jsonpickle.load(file)withjson.load(file)pickle.dump(words, file)withjson.dump(words, file, ensure_ascii=False)words.battowords.jsonto reflect the new formatWORDS_FILEpath to use.jsonextensionImpact that it would Provide
Note: Please assign this issue to the
tmdeveloper007account.