From da1a6b7ebca5fc7d35458d821c93331e9080e993 Mon Sep 17 00:00:00 2001 From: Yuval Elbar <41901908+YuvalElbar6@users.noreply.github.com> Date: Fri, 20 Feb 2026 16:36:26 +0200 Subject: [PATCH] Add security warning about pickle files in JOBDIR (#7274) * Add security warning about pickle files in JOBDIR The job directory contains files serialized with pickle (spider.state, request queues), which can execute arbitrary code when loaded. Add a warning so users know to treat JOBDIR with the same trust level as their project code. Co-Authored-By: Claude Opus 4.6 * Make JOBDIR security warning more concise and accurate Simplify the warning to focus on treating the job directory as trusted, without mentioning specific serialization details. Co-Authored-By: Claude Opus 4.6 --------- Co-authored-by: Claude Opus 4.6 --- docs/topics/jobs.rst | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/docs/topics/jobs.rst b/docs/topics/jobs.rst index 2a976e91d..769925dd5 100644 --- a/docs/topics/jobs.rst +++ b/docs/topics/jobs.rst @@ -31,6 +31,10 @@ job (i.e. a spider run), so that if stopped cleanly, it can be resumed later. .. warning:: This directory must *not* be shared by different spiders, or even different jobs of the same spider. +.. warning:: Treat the job directory with the same security care as your + Scrapy project source code. Do not point ``JOBDIR`` to a path that + untrusted parties can write to. + See also :ref:`job-dir-contents`. How to use it