add jsonpickle deserialization blacklist

[SugarP1g]

add jsonpickle deserialization blacklist

[sigmavirus24]

TIL: https://jsonpickle.github.io/

[JeremyVriens]

Good addition, but this triggered me to look a bit further ahead. What's the requirement/flow for other 3rd party libraries to be added to this static blacklist?
As an example: Pandas, another pretty big 3rd party lib, also has a pandas.read_pickle (https://github.com/pandas-dev/pandas/blob/9d0517a2f9c17377e8a7823e0af7776d3d9a0679/pandas/io/pickle.py#L217) which uses pickle.load. Currently when using pandas.read_pickle inside your code, Bandit won't complain. Should it be also added to the blacklist?

[SugarP1g]

Good addition, but this triggered me to look a bit further ahead. What's the requirement/flow for other 3rd party libraries to be added to this static blacklist?
As an example: Pandas, another pretty big 3rd party lib, also has a pandas.read_pickle (https://github.com/pandas-dev/pandas/blob/9d0517a2f9c17377e8a7823e0af7776d3d9a0679/pandas/io/pickle.py#L217) which uses pickle.load. Currently when using pandas.read_pickle inside your code, Bandit won't complain. Should it be also added to the blacklist?

It's a question about the purpose of bandit. If bandit is desired to find more vulnerability, this check rule should be added.

[sigmavirus24]

Good addition, but this triggered me to look a bit further ahead. What's the requirement/flow for other 3rd party libraries to be added to this static blacklist?

I don't know, but I'm pretty sure 3rd party libraries are already covered (I think we have checks for PyYAML). I think what's already covered is based upon what folks using it have needed thus far.

[ericwb]

Please add jsonpickle to a file in the examples, possibly pickle_deserialize.py or a new file. Then update test_functional.py to run bandit on that example to ensure the black listed call is correctly detected. Thanks!

[ericwb]

LGTM