How can I execute arbitrary code through JSON and how to misinform the input

Question

The Python jsonpickle module documentation for serializing and deserializing JSON says that

Downloading a JSON string from an untrusted source is a potential security vulnerability. jsonpickle is not trying to misinform the entry

But I am wondering how an attacker can execute arbitrary code through JSON messages?

Also, what is the best way to disinfect input, as suggested in the documentation? The JSON data in my application is not trustworthy (it came from clients sending JSON messages).

Answer 1

jsonpickle JSON. jsonpickle Python, . Sanitizing , JSON , jsonpickle. , .

__reduce__ (., , | jsonpickle)

jsonpickle.decode('{"py/object": "list", "py/reduce":[{"py/type": "subprocess.Popen"}, ["ls"], null, null, null]}')

- . .

, jsonpickle . JSON .