vulnerable_deserialization.py

import pickle
import yaml
import marshal
from flask import Flask, request

app = Flask(__name__)

@app.route('/load', methods=['POST'])
def load_data():
    data = request.data
    
    obj = pickle.loads(data)
    
    return str(obj)

@app.route('/session', methods=['POST'])
def restore_session():
    session_data = request.form.get('session')
    
    session = pickle.loads(session_data.encode())
    
    return f"Session restored: {session}"

def load_config(config_data):
    config = yaml.load(config_data)
    return config

def deserialize_object(serialized):
    return pickle.loads(serialized)

def load_user_preferences(pref_string):
    prefs = marshal.loads(pref_string)
    return prefs

@app.route('/import', methods=['POST'])
def import_data():
    import_file = request.files['file']
    content = import_file.read()
    
    data = pickle.loads(content)
    
    return f"Imported: {data}"

def process_yaml(yaml_content):
    parsed = yaml.load(yaml_content, Loader=yaml.Loader)
    return parsed

class DataProcessor:
    def load_from_bytes(self, byte_data):
        return pickle.loads(byte_data)
    
    def restore_state(self, state_data):
        self.__dict__ = pickle.loads(state_data)

if __name__ == '__main__':
    app.run(debug=True)