pickle and security

[Jason Miller]

As I understand it, the major security issue with unpickling untrusted
sources is that it may cause python to instantiate objects, calling
constructors that could do just about anything.  If I only want to
unpickle objects that are not class instances, and (using cPickle) I set
find_global to None, are there any security concerns that remain? It would
be very nice if doing this were sufficient to make it safe to unpickle
from, say a socket, but I would like to know if that is just a bad idea.


     -Jason