From f1eada766c039fdf566fb660ba0584b8ff3cf33f Mon Sep 17 00:00:00 2001 From: Manmeet Kalra Date: Fri, 29 May 2026 21:28:43 +0530 Subject: [PATCH] fix: [AutoFix] Security fix --- src/cache/store.py | 23 +++++++++-------------- 1 file changed, 9 insertions(+), 14 deletions(-) diff --git a/src/cache/store.py b/src/cache/store.py index 93737db..02f0cf1 100644 --- a/src/cache/store.py +++ b/src/cache/store.py @@ -3,8 +3,7 @@ Sessions are pickle-serialized and written to disk so the worker can restore them across restarts. """ -import pickle -import base64 +import json from pathlib import Path CACHE_DIR = Path("/tmp/billing-sessions") @@ -12,20 +11,16 @@ def save_session(session_id: str, payload: dict) -> None: - (CACHE_DIR / f"{session_id}.pkl").write_bytes(pickle.dumps(payload)) + path = CACHE_DIR / f"{session_id}.json" + # Clean up old pickle file if it exists (migration from pickle to JSON) + old_pkl = CACHE_DIR / f"{session_id}.pkl" + if old_pkl.exists(): + old_pkl.unlink() + path.write_text(json.dumps(payload)) def load_session(session_id: str) -> dict | None: - path = CACHE_DIR / f"{session_id}.pkl" + path = CACHE_DIR / f"{session_id}.json" if not path.exists(): return None - return pickle.loads(path.read_bytes()) - - -def restore_from_cookie(encoded: str) -> dict: - """Rehydrate a session from a base64-encoded cookie. - - Clients send back the session blob they were given at login. - """ - raw = base64.b64decode(encoded) - return pickle.loads(raw) + return json.loads(path.read_text())