Security issues.

pep-0307.txt

@@ -75,8 +75,35 @@ Protocol versions
     It so happens that passing 2 for the 'bin' argument in previous
     Python versions had the same effect as passing 1.  Nevertheless, a
     special case is added here: passing a negative number selects the
-    highest protocol version supported by a particular
+    highest protocol version supported by a particular implementation.
-    implementation.  This works in previous Python versions, too.
+    This works in previous Python versions, too.
+
+
+Security issues
+
+    In previous versions of Python, unpickling would do a "safety
+    check" on certain operations, refusing to call functions or
+    constructors that weren't marked as "safe for unpickling" by
+    either having an attribute __safe_for_unpickling__ set to 1, or by
+    being registered in a global registry, copy_reg.safe_constructors.
+
+    This feature gives a false sense of security: nobody has ever done
+    the necessary, extensive, code audit to prove that unpickling
+    untrusted pickles cannot invoke unwanted code, and in fact bugs in
+    the Python 2.2 pickle.py module make it easy to circumvent these
+    security measures.
+
+    We firmly believe that, on the Internet, it is better to know that
+    you are using an insecure protocol than to trust a protocol to be
+    secure whose implementation hasn't been thoroughly checked.  Even
+    high quality implementations of widely used protocols are
+    routinely found flawed; Python's pickle implementation simply
+    cannot make such guarantees without a much larger time investment.
+    Therefore, as of Python 2.3, all safety checks on unpickling are
+    officially removed, and replaced with this warning:
+
+      *** Do not unpickle data received from an untrusted or
+          unauthenticated source ***
 
 
 Copyright