def test_JSerializableExploit():
"""Test that we cannot execute arbitrary code with JENcode"""
exploit = '{"__dCls": "exit", "__dMod": "sys"}'
with raises(TypeError):
jsonDecode(exploit)
def test_nonDeclaredAttr():
""" Tests that an argument not in the list of arguments to serialized
is not serialized
"""
objData = Serializable()
objData.notToBeSerialized = 1
encodedData = jsonEncode(objData)
decodedData, _lenData = jsonDecode(encodedData)
assert not hasattr(decodedData, 'notToBeSerialized')
def test_nonDeclaredAttr():
""" Tests that an argument not in the list of arguments to serialized
is not serialized
"""
objData = Serializable()
objData.notToBeSerialized = 1
encodedData = jsonEncode(objData)
decodedData, _lenData = jsonDecode(encodedData)
assert not hasattr(decodedData, 'notToBeSerialized')