From b3a797ae7edb42fd53b3d435b0fdf11e6c97a02c Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?C=C3=A9dric=20Krier?= <ced@b2ck.com>
Date: Mon, 4 Feb 2008 23:16:28 +0100
Subject: [PATCH] Improve security when using cPickle

---
 tryton/pysocket.py | 6 +++++-
 1 file changed, 5 insertions(+), 1 deletion(-)

diff --git a/tryton/pysocket.py b/tryton/pysocket.py
index dc794dba24..659cb8e577 100644
--- a/tryton/pysocket.py
+++ b/tryton/pysocket.py
@@ -1,5 +1,6 @@
 import socket
 import cPickle
+import cStringIO
 
 DNS_CACHE = {}
 
@@ -83,7 +84,10 @@ class PySocket:
             if chunk == '':
                 raise RuntimeError, "socket connection broken"
             msg = msg + chunk
-        res = cPickle.loads(msg)
+        msgio = cStringIO.StringIO(msg)
+        unpickler = cPickle.Unpickler(msgio)
+        unpickler.find_global = None
+        res = unpickler.load()
         if isinstance(res[0], Exception):
             if exception:
                 raise PySocketException(str(res[0]), str(res[1]))