title: Python: can I safely unpickle untrusted data?
body: <p>The <a href="https://docs.python.org/3/library/pickle.html#pickle-python-object-serialization" rel="noreferrer">pickle module documentation</a> says right at the beginning:</p>
  
  <blockquote>
    <p><strong>Warning</strong>: 
    The pickle module is not intended to be secure against erroneous or
    maliciously constructed data. Never unpickle data received from an
    untrusted or unauthenticated source.</p>
  </blockquote>
  
  <p>However, further down under <a href="https://docs.python.org/3/library/pickle.html#restricting-globals" rel="noreferrer">restricting globals</a> it seems to describe a way to make unpickling data safe using a whitelist of allowed objects.</p>
  
  <p>Does this mean that I can safely unpickle untrusted data if I use a <code>RestrictedUnpickler</code> that allows only some "elementary" types, or are there additional security issues that are not addressed by this method? If there are, is there another way to make unpickling safe (obviously at the cost of not being able to unpickle every stream)?</p>
  
  <p>With "elementary types" I mean precisely the following:</p>
  
  <ul>
  <li><code>bool</code></li>
  <li><code>str</code>, <code>bytes</code>, <code>bytearray</code></li>
  <li><code>int</code>, <code>float</code>, <code>complex</code></li>
  <li><code>tuple</code>, <code>list</code>, <code>dict</code>, <code>set</code> and <code>frozenset</code></li>
  </ul>