rules:
- id: marshal-usage
  languages:
  - python
  message: >-
    The marshal module is not intended to be secure against erroneous or maliciously
    constructed data.
    Never unmarshal data received from an untrusted or unauthenticated source.
    See more details: https://docs.python.org/3/library/marshal.html?highlight=security
  metadata:
    cwe: 'CWE-502: Deserialization of Untrusted Data'
    owasp: 'A8: Insecure Deserialization'
    references:
    - https://docs.python.org/3/library/marshal.html?highlight=security
    category: security
    technology:
    - python
  pattern-either:
  - pattern: marshal.dump(...)
  - pattern: marshal.dumps(...)
  - pattern: marshal.load(...)
  - pattern: marshal.loads(...)
  severity: WARNING