How to disallow pickle serialization in celery

python security celery
Leopd picture Leopd · Jul 8, 2011 · Viewed 14.2k times · Source

Celery defaults to using pickle as its serialization method for tasks. As noted in the FAQ, this represents a security hole. Celery allows you to configure how tasks get serialized using the CELERY_TASK_SERIALIZER configuration parameter.

But this doesn't solve the security problem. Even if tasks are serialized with JSON or similar, the workers will still execute tasks inserted into the queue with pickle serialization -- they just respond to the content-type parameter in the message. So anybody who can write to the task queue can effectively pown the worker processes by writing malicious pickled objects.

How can I prevent the worker threads from running tasks serialized with pickle?

Answer

naoko picture naoko · Jan 5, 2014

I was getting "ContentDisallowed: Refusing to deserialize untrusted content of type pickle (application/x-python-serialize)"

having:

CELERY_ACCEPT_CONTENT = ['json']

wasn't enough... I had to also add the followings to settings:

CELERY_TASK_SERIALIZER = 'json'
CELERY_RESULT_SERIALIZER = 'json'

Related questions

Hiding a password in a python script (insecure obfuscation only)

I have got a python script which is creating an ODBC connection. The ODBC connection is generated with a connection string. In this connection string I have to include the username and password for this connection. Is there an easy …

Read More
Securely storing passwords for use in python script

Possible Duplicate: I need to securely store a username and password in Python, what are my options? I am looking for a way to securely store passwords which I intend to use in some Python scripting. I will be logging …

Read More
High quality, simple random password generator

I'm interested in creating a very simple, high (cryptographic) quality random password generator. Is there a better way to do this? import os, random, string length = 13 chars = string.ascii_letters + string.digits + '!@#$%^&*()' random.seed = (os.urandom(1024)) print …

Read More