bandit/examples/pickle_deserialize.py
Ian Cordasco 4af7ea6a20 Update example files to work on Python 2 & 3
Almost all of the problems were using print statements instead of
equivalent Python 3 syntax. You'll notice that in Python 2, the AST
parses `print(...)` and `print ...` equivalently:

    $ python
    Python 2.7.9 (default, Dec 15 2014, 10:01:34)
    [GCC 4.2.1 Compatible Apple LLVM 6.0 (clang-600.0.56)] on darwin
    Type "help", "copyright", "credits" or "license" for more information.
    >>> import ast
    >>> body = ast.parse('print("Foo")').body[0]
    >>> body
    <_ast.Print object at 0x1033452d0>
    >>> body.values
    [<_ast.Str object at 0x103345310>]
    >>> body2 = ast.parse('print "Foo"').body[0]
    >>> body2
    <_ast.Print object at 0x103345350>
    >>> body2.values
    [<_ast.Str object at 0x103345390>]

This leaves 2 files - exec.py, os-chmod.py - which are skipped due to
syntax errors on Python 3.4.

Change-Id: I2d97a249503317092372a874c018561cf875b066
2015-06-03 16:28:36 +00:00

30 lines
546 B
Python

import cPickle
import pickle
import StringIO
# pickle
pick = pickle.dumps({'a': 'b', 'c': 'd'})
print(pickle.loads(pick))
file_obj = StringIO.StringIO()
pickle.dump([1, 2, '3'], file_obj)
file_obj.seek(0)
print(pickle.load(file_obj))
file_obj.seek(0)
print(pickle.Unpickler(file_obj).load())
# cPickle
serialized = cPickle.dumps({(): []})
print(cPickle.loads(serialized))
file_obj = StringIO.StringIO()
cPickle.dump((1,), file_obj)
file_obj.seek(0)
print(cPickle.load(file_obj))
file_obj.seek(0)
print(cPickle.Unpickler(file_obj).load())