RomanNum3ral
/
scrapy
mirror of https://github.com/scrapy/scrapy.git
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

Add security warning about pickle files in JOBDIR (#7274) 

* Add security warning about pickle files in JOBDIR

The job directory contains files serialized with pickle (spider.state,
request queues), which can execute arbitrary code when loaded. Add a
warning so users know to treat JOBDIR with the same trust level as
their project code.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

* Make JOBDIR security warning more concise and accurate

Simplify the warning to focus on treating the job directory
as trusted, without mentioning specific serialization details.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

---------

Co-authored-by: Claude Opus 4.6 <noreply@anthropic.com>
This commit is contained in:
Yuval Elbar 2026-02-20 16:36:26 +02:00 committed by GitHub
parent 3fe89a211b
commit da1a6b7ebc
No known key found for this signature in database
GPG Key ID: B5690EEEBB952194
1 changed files with 4 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

4
docs/topics/jobs.rst
View File

@ -31,6 +31,10 @@ job (i.e. a spider run), so that if stopped cleanly, it can be resumed later.
.. warning:: This directory must *not* be shared by different spiders, or even
different jobs of the same spider.
.. warning:: Treat the job directory with the same security care as your
Scrapy project source code. Do not point ``JOBDIR`` to a path that
untrusted parties can write to.
See also :ref:`job-dir-contents`.
How to use it