Python Treat Serialized Data as Untrusted Input

Parsed data is still untrusted data, regardless of file format.

How It Works

A successful JSON, CSV, TOML or XML parse shows that syntax is acceptable, not that the values are allowed. Validate types, lengths, ranges and permitted field names before using parsed values. Never deserialize untrusted pickle data because loading it can execute code.

Schema validation complements, but does not replace, output encoding and safe APIs for databases, HTML and shell commands.

Step-by-Step Example

import json

payload = '{"username": "reader", "limit": 15}'
data = json.loads(payload)
if not isinstance(data, dict):
    raise ValueError("Expected an object")
if not isinstance(data.get("limit"), int) or isinstance(data["limit"], bool):
    raise ValueError("limit must be an integer")
if not 1 <= data["limit"] <= 100:
    raise ValueError("limit must be between 1 and 100")
print(data["limit"])

Understanding the Example

• The expression '\'{"username": "reader", "limit": 15}\'' supplies the value stored as 'payload'. This value is then used or checked by the later statements.
• The expression 'json.loads(payload)' supplies the value stored as 'data'. This value is then used or checked by the later statements.

A successful run of this example prints the following output:

15

Where This Fits in a Real Program

In a real import pipeline, parsing is only the first stage. Convert each field to the intended type, reject missing or unexpected values and report which record failed. Keep the original source file unchanged until the normalized data has passed validation and an export has been checked.

Practice: Try It Yourself

Change limit to true, a negative number and a large value; confirm that each is rejected.

For this exercise, predict the result before running the changed code. Then explain the difference between the original and modified cases using the actual values, not just whether the program completed.

Further Reading

Read the official Python documentation for complete parameters, return types and exceptions.

Common Beginner Mistakes

• Assuming that valid JSON always has the dictionary shape an application expects.
• Passing user-controlled values to shell commands, filesystem paths or SQL without context-specific protection.

Key Takeaways

• Parsed data is still untrusted data, regardless of file format.
• A successful JSON, CSV, TOML or XML parse shows that syntax is acceptable, not that the values are allowed.
• Schema validation complements, but does not replace, output encoding and safe APIs for databases, HTML and shell commands.