Deserialization of untrusted object
Deserialization of untrusted or potentially malformed data can be exploited for denial of service or to induce running untrusted code.
def untrusted_deserialization_noncompliant():
    import jsonpickle
    userobj = input("user")
    # Noncompliant: Untrusted object deserialized without validation.
    obj = jsonpickle.decode(userobj)
    return obj
def untrusted_deserialization_compliant():
    import jsonpickle
    userobj = input("user")
    allowed_user_obj = ['example_module1', 'example_module2']
    # Compliant: Untrusted object is validated before deserialization.
    if userobj in allowed_user_obj:
        obj = jsonpickle.decode(userobj)
        return obj