| <!doctype html><html lang=zh-CN dir=ltr class="docs-wrapper plugin-docs plugin-id-default docs-version-1.6.0 docs-doc-page docs-doc-id-object-serialization/python/security" data-has-hydrated=false><head><meta charset=UTF-8><meta name=generator content="Docusaurus v3.10.1"><title data-rh=true>安全 | Apache Fory™</title><meta data-rh=true name=viewport content="width=device-width, initial-scale=1.0"/><meta data-rh=true property=og:url content=https://fory.apache.org/zh-CN/docs/object-serialization/python/security /><meta data-rh=true property=og:locale content=zh_CN /><meta data-rh=true property=og:locale:alternate content=en_US /><meta data-rh=true name=docusaurus_locale content=zh-CN /><meta data-rh=true name=docsearch:language content=zh-CN /><meta data-rh=true http-equiv=Content-Security-Policy content="frame-src 'self' https://ghbtns.com/;"/><meta data-rh=true property=og:image content=https://fory.apache.org/img/logo.png /><meta data-rh=true property=og:image:width content=1500 /><meta data-rh=true property=og:image:height content=1500 /><meta data-rh=true name=twitter:card content=summary_large_image /><meta data-rh=true name=twitter:image content=https://fory.apache.org/img/logo.png /><meta data-rh=true name=docusaurus_version content=1.6.0 /><meta data-rh=true name=docusaurus_tag content=docs-default-1.6.0 /><meta data-rh=true name=docsearch:version content=1.6.0 /><meta data-rh=true name=docsearch:docusaurus_tag content=docs-default-1.6.0 /><meta data-rh=true property=og:title content="安全 | Apache Fory™"/><meta data-rh=true name=description content="当 Python 读取端接收来自应用信任边界之外的字节时，请遵循本页说明。Fory 会重建应用值，"/><meta data-rh=true property=og:description content="当 Python 读取端接收来自应用信任边界之外的字节时，请遵循本页说明。Fory 会重建应用值，"/><link data-rh=true rel=icon href=/zh-CN/img/favicon.ico /><link data-rh=true rel=canonical href=https://fory.apache.org/zh-CN/docs/object-serialization/python/security /><link data-rh=true rel=alternate href=https://fory.apache.org/docs/object-serialization/python/security hreflang=en-US /><link data-rh=true rel=alternate href=https://fory.apache.org/zh-CN/docs/object-serialization/python/security hreflang=zh-CN /><link data-rh=true rel=alternate href=https://fory.apache.org/docs/object-serialization/python/security hreflang=x-default /><script data-rh=true type=application/ld+json>{"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","item":"https://fory.apache.org/zh-CN/docs/object-serialization/python/","name":"Python","position":1},{"@type":"ListItem","item":"https://fory.apache.org/zh-CN/docs/object-serialization/python/security","name":"安全","position":2}]}</script><link rel=alternate type=application/rss+xml href=/zh-CN/blog/rss.xml title="Apache Fory™ RSS Feed"><link rel=alternate type=application/atom+xml href=/zh-CN/blog/atom.xml title="Apache Fory™ Atom Feed"><script type=text/javascript>"fury.apache.org"===window.location.host&&(window.location.href="https://fory.apache.org"),function(){var i=["0.17","0.16","0.15","0.14","0.13","0.12","0.11","0.10"];if(0!==i.length){var t=window.location.pathname.split("/").filter(Boolean),a=/^[a-z]{2}-[A-Z]{2}$/.test(t[0])?t[0]:null,e=+!!a;if(!("docs"!==t[e]||0>i.indexOf(t[e+1]))){var o=["/archive"];a&&o.push(a),o.push.apply(o,t.slice(e));var n=window.location.pathname.endsWith("/")?"/":"";window.location.replace(o.join("/")+n+window.location.search+window.location.hash)}}}(),function(){var i=window.location.pathname.split("/").filter(Boolean),t="docs"===i[0]?0:/^[a-z]{2}-[A-Z]{2}$/.test(i[0])&&"docs"===i[1]?1:-1;if(!(t<0)){var a=t+1,e=i[a];if(!/^[0-9]+[.][0-9]+(?:[.][0-9]+)?$/.test(e)){"next"===e&&a++;var o=i.slice(a).join("/"),n=o.split("/"),r=2===n.length&&"guide"===n[0]?n[1]:null,s=r&&["cpp","csharp","dart","go","java","javascript","kotlin","python","rust","scala","swift"].indexOf(r)>=0?"object-serialization/"+r:({"introduction/overview":"introduction","introduction/benchmark":"benchmarks","start/install":"start","start/usage":"start","guide/xlang":"object-serialization/xlang","guide/xlang/getting_started":"object-serialization/xlang","guide/xlang/serialization":"object-serialization/xlang","guide/java/json_support":"json","guide/rust/external_types":"object-serialization/rust/external-types","guide/dart/external_types":"object-serialization/dart/external-types","guide/swift/external_types":"object-serialization/swift/external-types","guide/csharp/external_types":"object-serialization/csharp/external-types","guide/csharp/basic_serialization":"object-serialization/csharp/basic-serialization","guide/dart/inheritance":"object-serialization/dart/inheritance","benchmarks/rust":"benchmarks/object-serialization/xlang/rust","compiler/compiler_guide":"compiler/getting-started","community/development":"development"})[o];if(s){var l="/"+i.slice(0,a).join("/");window.location.replace(l+"/"+s+"/"+window.location.search+window.location.hash)}}}}(),function(){var i=window.location.pathname,t=i.split("/").filter(Boolean),a="docs"===t[0]?0:/^[a-z]{2}-[A-Z]{2}$/.test(t[0])&&"docs"===t[1]?1:-1;if(!(a<0)){var e=a+1,o=t[e];if(("next"===o||/^[0-9]+[.][0-9]+(?:[.][0-9]+)?$/.test(o))&&e++,!("docs"!==t[e]||0>["guide","introduction","start"].indexOf(t[e+1]))){t.splice(e,1);var n="/"+t.join("/");i.endsWith("/")&&(n+="/"),window.location.replace(n+window.location.search+window.location.hash)}}}()</script><link rel=stylesheet href=/zh-CN/assets/css/styles.eba6f8f8.css /><script src=/zh-CN/assets/js/runtime~main.6f1e156c.js defer></script><script src=/zh-CN/assets/js/main.20a19775.js defer></script></head><body><svg style="display: none;"><defs> |
| <symbol id=theme-svg-external-link viewBox="0 0 24 24"><path fill=currentColor d="M21 13v10h-21v-19h12v2h-10v15h17v-8h2zm3-12h-10.988l4.035 4-6.977 7.07 2.828 2.828 6.977-7.07 4.125 4.172v-11z"/></symbol> |
| </defs></svg> |
| <script>!function(){var t=function(){try{return new URLSearchParams(window.location.search).get("docusaurus-theme")}catch(t){}}()||function(){try{return window.localStorage.getItem("theme")}catch(t){}}();document.documentElement.setAttribute("data-theme",t||"light"),document.documentElement.setAttribute("data-theme-choice",t||"light")}(),function(){try{for(var[t,e]of new URLSearchParams(window.location.search).entries())if(t.startsWith("docusaurus-data-")){var a=t.replace("docusaurus-data-","data-");document.documentElement.setAttribute(a,e)}}catch(t){}}()</script><div id=__docusaurus><div role=region aria-label=跳到主要内容><a class=skipToContent_fXgn href=#__docusaurus_skipToContent_fallback>跳到主要内容</a></div><nav aria-label=主导航 class="theme-layout-navbar navbar navbar--fixed-top"><div class=navbar__inner><div class="theme-layout-navbar-left navbar__items"><button aria-label=切换导航栏 aria-expanded=false class="navbar__toggle clean-btn" type=button><svg width=30 height=30 viewBox="0 0 30 30" aria-hidden=true><path stroke=currentColor stroke-linecap=round stroke-miterlimit=10 stroke-width=2 d="M4 7h22M4 15h22M4 23h22"/></svg></button><a class=navbar__brand href=/zh-CN/><div class=navbar__logo><img src=/zh-CN/img/fory-logo-light.png alt="Fory Logo" class="themedComponent_mlkZ themedComponent--light_NVdE"/><img src=/zh-CN/img/fory-logo-dark.png alt="Fory Logo" class="themedComponent_mlkZ themedComponent--dark_xIcU"/></div><b class="navbar__title text--truncate"></b></a><a aria-current=page class="navbar__item navbar__link navbar__link--active" href=/zh-CN/docs/introduction/>文档</a><a class="navbar__item navbar__link" href=/zh-CN/docs/specification/xlang_serialization_spec>规范</a><a class="navbar__item navbar__link" href=/zh-CN/docs/community/>社区</a><a class="navbar__item navbar__link" href=/zh-CN/user>用户</a><a class="navbar__item navbar__link" href=/zh-CN/download>下载</a><a class="navbar__item navbar__link" href=/zh-CN/blog>博客</a></div><div class="theme-layout-navbar-right navbar__items navbar__items--right"><div class="navbar__item dropdown dropdown--hoverable dropdown--right"><a href=# aria-haspopup=true aria-expanded=false role=button class=navbar__link>ASF</a><ul class=dropdown__menu><li><a href=https://www.apache.org/ target=_blank rel="noopener noreferrer" class=dropdown__link>基金会</a><li><a href=https://www.apache.org/licenses/ target=_blank rel="noopener noreferrer" class=dropdown__link>许可证</a><li><a href=https://www.apache.org/events/current-event.html target=_blank rel="noopener noreferrer" class=dropdown__link>事件</a><li><a href=https://privacy.apache.org/policies/privacy-policy-public.html target=_blank rel="noopener noreferrer" class=dropdown__link>隐私</a><li><a href=https://www.apache.org/security/ target=_blank rel="noopener noreferrer" class=dropdown__link>安全</a><li><a href=https://www.apache.org/foundation/sponsorship.html target=_blank rel="noopener noreferrer" class=dropdown__link>赞助</a><li><a href=https://www.apache.org/foundation/thanks.html target=_blank rel="noopener noreferrer" class=dropdown__link>感谢</a><li><a href=https://www.apache.org/foundation/policies/conduct.html target=_blank rel="noopener noreferrer" class=dropdown__link>行为准则</a></ul></div><div class="navbar__item dropdown dropdown--hoverable dropdown--right"><a class=navbar__link aria-haspopup=true aria-expanded=false role=button href=/zh-CN/docs/object-serialization/python/security>1.6.0</a><ul class=dropdown__menu><li><a class=dropdown__link href=/zh-CN/docs/next/object-serialization/python/security>dev</a><li><a aria-current=page class="dropdown__link dropdown__link--active" href=/zh-CN/docs/object-serialization/python/security>1.6.0</a><li><a class=dropdown__link href=/zh-CN/docs/1.5/introduction/overview>1.5.0</a><li><a class=dropdown__link href=/zh-CN/docs/1.4/introduction/overview>1.4.0</a><li><a class=dropdown__link href=/zh-CN/docs/1.3/introduction/overview>1.3.0</a><li><a class=dropdown__link href=/zh-CN/docs/1.2/introduction/overview>1.2.0</a><li><a class=dropdown__link href=/zh-CN/docs/1.1/introduction/overview>1.1.0</a><li><a class=dropdown__link href=/zh-CN/docs/1.0/introduction/overview>1.0.0</a><li><a href=https://fory.apache.org/archive/zh-CN/docs/0.17/introduction/overview/ target=_blank rel="noopener noreferrer" class=dropdown__link>更多版本<svg width=12 height=12 aria-label="(opens in new tab)" class=iconExternalLink_nPIU><use href=#theme-svg-external-link /></svg></a></ul></div><a href=https://github.com/apache/fory target=_blank rel="noopener noreferrer" class="navbar__item navbar__link header-github-link" aria-label="GitHub repository"></a><div class="navbar__item dropdown dropdown--hoverable dropdown--right"><a href=# aria-haspopup=true aria-expanded=false role=button class=navbar__link><svg viewBox="0 0 24 24" width=20 height=20 aria-hidden=true class=iconLanguage_nlXk><path fill=currentColor d="M12.87 15.07l-2.54-2.51.03-.03c1.74-1.94 2.98-4.17 3.71-6.53H17V4h-7V2H8v2H1v1.99h11.17C11.5 7.92 10.44 9.75 9 11.35 8.07 10.32 7.3 9.19 6.69 8h-2c.73 1.63 1.73 3.17 2.98 4.56l-5.09 5.02L4 19l5-5 3.11 3.11.76-2.04zM18.5 10h-2L12 22h2l1.12-3h4.75L21 22h2l-4.5-12zm-2.62 7l1.62-4.33L19.12 17h-3.24z"/></svg>简体中文</a><ul class=dropdown__menu><li><a href=/docs/object-serialization/python/security target=_self rel="noopener noreferrer" class=dropdown__link lang=en-US>English</a><li><a href=/zh-CN/docs/object-serialization/python/security target=_self rel="noopener noreferrer" class="dropdown__link dropdown__link--active" lang=zh-CN>简体中文</a></ul></div><div class="toggle_vylO colorModeToggle_DEke"><button class="clean-btn toggleButton_gllP toggleButtonDisabled_aARS" type=button disabled title="system mode" aria-label="切换浅色/暗黑模式（当前为system mode）"><svg viewBox="0 0 24 24" width=24 height=24 aria-hidden=true class="toggleIcon_g3eP lightToggleIcon_pyhR"><path fill=currentColor d="M12,9c1.65,0,3,1.35,3,3s-1.35,3-3,3s-3-1.35-3-3S10.35,9,12,9 M12,7c-2.76,0-5,2.24-5,5s2.24,5,5,5s5-2.24,5-5 S14.76,7,12,7L12,7z M2,13l2,0c0.55,0,1-0.45,1-1s-0.45-1-1-1l-2,0c-0.55,0-1,0.45-1,1S1.45,13,2,13z M20,13l2,0c0.55,0,1-0.45,1-1 s-0.45-1-1-1l-2,0c-0.55,0-1,0.45-1,1S19.45,13,20,13z M11,2v2c0,0.55,0.45,1,1,1s1-0.45,1-1V2c0-0.55-0.45-1-1-1S11,1.45,11,2z M11,20v2c0,0.55,0.45,1,1,1s1-0.45,1-1v-2c0-0.55-0.45-1-1-1C11.45,19,11,19.45,11,20z M5.99,4.58c-0.39-0.39-1.03-0.39-1.41,0 c-0.39,0.39-0.39,1.03,0,1.41l1.06,1.06c0.39,0.39,1.03,0.39,1.41,0s0.39-1.03,0-1.41L5.99,4.58z M18.36,16.95 c-0.39-0.39-1.03-0.39-1.41,0c-0.39,0.39-0.39,1.03,0,1.41l1.06,1.06c0.39,0.39,1.03,0.39,1.41,0c0.39-0.39,0.39-1.03,0-1.41 L18.36,16.95z M19.42,5.99c0.39-0.39,0.39-1.03,0-1.41c-0.39-0.39-1.03-0.39-1.41,0l-1.06,1.06c-0.39,0.39-0.39,1.03,0,1.41 s1.03,0.39,1.41,0L19.42,5.99z M7.05,18.36c0.39-0.39,0.39-1.03,0-1.41c-0.39-0.39-1.03-0.39-1.41,0l-1.06,1.06 c-0.39,0.39-0.39,1.03,0,1.41s1.03,0.39,1.41,0L7.05,18.36z"/></svg><svg viewBox="0 0 24 24" width=24 height=24 aria-hidden=true class="toggleIcon_g3eP darkToggleIcon_wfgR"><path fill=currentColor d="M9.37,5.51C9.19,6.15,9.1,6.82,9.1,7.5c0,4.08,3.32,7.4,7.4,7.4c0.68,0,1.35-0.09,1.99-0.27C17.45,17.19,14.93,19,12,19 c-3.86,0-7-3.14-7-7C5,9.07,6.81,6.55,9.37,5.51z M12,3c-4.97,0-9,4.03-9,9s4.03,9,9,9s9-4.03,9-9c0-0.46-0.04-0.92-0.1-1.36 c-0.98,1.37-2.58,2.26-4.4,2.26c-2.98,0-5.4-2.42-5.4-5.4c0-1.81,0.89-3.42,2.26-4.4C12.92,3.04,12.46,3,12,3L12,3z"/></svg><svg viewBox="0 0 24 24" width=24 height=24 aria-hidden=true class="toggleIcon_g3eP systemToggleIcon_QzmC"><path fill=currentColor d="m12 21c4.971 0 9-4.029 9-9s-4.029-9-9-9-9 4.029-9 9 4.029 9 9 9zm4.95-13.95c1.313 1.313 2.05 3.093 2.05 4.95s-0.738 3.637-2.05 4.95c-1.313 1.313-3.093 2.05-4.95 2.05v-14c1.857 0 3.637 0.737 4.95 2.05z"/></svg></button></div><div class=navbarSearchContainer_Bca1><div class=navbar__search><span aria-label="expand searchbar" role=button class=search-icon tabindex=0></span><input id=search_input_react type=search placeholder=Loading... aria-label=Search class="navbar__search-input search-bar" disabled/></div></div></div></div><div role=presentation class=navbar-sidebar__backdrop></div></nav><div id=__docusaurus_skipToContent_fallback class="theme-layout-main main-wrapper mainWrapper_z2l0"><div class=docsWrapper_hBAB><button aria-label=回到顶部 class="clean-btn theme-back-to-top-button backToTopButton_sjWU" type=button></button><div class=docRoot_UBD9><aside class="theme-doc-sidebar-container docSidebarContainer_YfHR"><div class=sidebarViewport_aRkj><div class=sidebar_njMd><nav aria-label=文档侧边栏 class="menu thin-scrollbar menu_SIkG"><ul class="theme-doc-sidebar-menu menu__list"><li class="theme-doc-sidebar-item-category theme-doc-sidebar-item-category-level-1 menu__list-item menu__list-item--collapsed"><div class=menu__list-item-collapsible><a class="categoryLink_byQd menu__link menu__link--sublist menu__link--sublist-caret" role=button aria-expanded=false href=/zh-CN/docs/introduction/><span title=简介 class=categoryLinkLabel_W154>简介</span></a></div><li class="theme-doc-sidebar-item-category theme-doc-sidebar-item-category-level-1 menu__list-item menu__list-item--collapsed"><div class=menu__list-item-collapsible><a class="categoryLink_byQd menu__link menu__link--sublist menu__link--sublist-caret" role=button aria-expanded=false href=/zh-CN/docs/start/><span title=快速开始 class=categoryLinkLabel_W154>快速开始</span></a></div><li class="theme-doc-sidebar-item-category theme-doc-sidebar-item-category-level-1 menu__list-item menu__list-item--collapsed"><div class=menu__list-item-collapsible><a class="categoryLink_byQd menu__link menu__link--sublist menu__link--sublist-caret" role=button aria-expanded=false href=/zh-CN/docs/benchmarks/><span title=基准测试 class=categoryLinkLabel_W154>基准测试</span></a></div><li class="theme-doc-sidebar-item-category theme-doc-sidebar-item-category-level-1 menu__list-item"><div class=menu__list-item-collapsible><a class="categoryLink_byQd menu__link menu__link--sublist menu__link--sublist-caret menu__link--active" role=button aria-expanded=true href=/zh-CN/docs/object-serialization/><span title=对象序列化 class=categoryLinkLabel_W154>对象序列化</span></a></div><ul class=menu__list><li class="theme-doc-sidebar-item-link theme-doc-sidebar-item-link-level-2 menu__list-item"><a class=menu__link tabindex=0 href=/zh-CN/docs/object-serialization/><span title=介绍 class=linkLabel_WmDU>介绍</span></a><li class="theme-doc-sidebar-item-link theme-doc-sidebar-item-link-level-2 menu__list-item"><a class=menu__link tabindex=0 href=/zh-CN/docs/object-serialization/core-concepts><span title=核心概念 class=linkLabel_WmDU>核心概念</span></a><li class="theme-doc-sidebar-item-link theme-doc-sidebar-item-link-level-2 menu__list-item"><a class=menu__link tabindex=0 href=/zh-CN/docs/object-serialization/xlang><span title="Xlang 序列化" class=linkLabel_WmDU>Xlang 序列化</span></a><li class="theme-doc-sidebar-item-link theme-doc-sidebar-item-link-level-2 menu__list-item"><a class=menu__link tabindex=0 href=/zh-CN/docs/object-serialization/native><span title=原生序列化 class=linkLabel_WmDU>原生序列化</span></a><li class="theme-doc-sidebar-item-category theme-doc-sidebar-item-category-level-2 menu__list-item menu__list-item--collapsed"><div class=menu__list-item-collapsible><a class="categoryLink_byQd menu__link menu__link--sublist" tabindex=0 href=/zh-CN/docs/object-serialization/java/><span title=Java class=categoryLinkLabel_W154>Java</span></a><button aria-label="展开侧边栏分类 'Java'" aria-expanded=false type=button class="clean-btn menu__caret"></button></div><li class="theme-doc-sidebar-item-category theme-doc-sidebar-item-category-level-2 menu__list-item"><div class=menu__list-item-collapsible><a class="categoryLink_byQd menu__link menu__link--sublist menu__link--active" tabindex=0 href=/zh-CN/docs/object-serialization/python/><span title=Python class=categoryLinkLabel_W154>Python</span></a><button aria-label="折叠侧边栏分类 'Python'" aria-expanded=true type=button class="clean-btn menu__caret"></button></div><ul class=menu__list><li class="theme-doc-sidebar-item-link theme-doc-sidebar-item-link-level-3 menu__list-item"><a class=menu__link tabindex=0 href=/zh-CN/docs/object-serialization/python/basic-serialization><span title=基础序列化 class=linkLabel_WmDU>基础序列化</span></a><li class="theme-doc-sidebar-item-link theme-doc-sidebar-item-link-level-3 menu__list-item"><a class=menu__link tabindex=0 href=/zh-CN/docs/object-serialization/python/native><span title="Python 原生序列化" class=linkLabel_WmDU>Python 原生序列化</span></a><li class="theme-doc-sidebar-item-link theme-doc-sidebar-item-link-level-3 menu__list-item"><a class=menu__link tabindex=0 href=/zh-CN/docs/object-serialization/python/configuration><span title=配置 class=linkLabel_WmDU>配置</span></a><li class="theme-doc-sidebar-item-link theme-doc-sidebar-item-link-level-3 menu__list-item"><a class=menu__link tabindex=0 href=/zh-CN/docs/object-serialization/python/type-registration><span title=类型注册 class=linkLabel_WmDU>类型注册</span></a><li class="theme-doc-sidebar-item-link theme-doc-sidebar-item-link-level-3 menu__list-item"><a class=menu__link tabindex=0 href=/zh-CN/docs/object-serialization/python/schema-evolution><span title="Schema 演进" class=linkLabel_WmDU>Schema 演进</span></a><li class="theme-doc-sidebar-item-link theme-doc-sidebar-item-link-level-3 menu__list-item"><a class=menu__link tabindex=0 href=/zh-CN/docs/object-serialization/python/schema-metadata><span title="Schema 元数据" class=linkLabel_WmDU>Schema 元数据</span></a><li class="theme-doc-sidebar-item-link theme-doc-sidebar-item-link-level-3 menu__list-item"><a class=menu__link tabindex=0 href=/zh-CN/docs/object-serialization/python/custom-serializers><span title=自定义序列化器 class=linkLabel_WmDU>自定义序列化器</span></a><li class="theme-doc-sidebar-item-link theme-doc-sidebar-item-link-level-3 menu__list-item"><a class=menu__link tabindex=0 href=/zh-CN/docs/object-serialization/python/functions-classes-methods><span title=函数、类与方法 class=linkLabel_WmDU>函数、类与方法</span></a><li class="theme-doc-sidebar-item-link theme-doc-sidebar-item-link-level-3 menu__list-item"><a class=menu__link tabindex=0 href=/zh-CN/docs/object-serialization/python/serialization-hooks><span title=序列化钩子 class=linkLabel_WmDU>序列化钩子</span></a><li class="theme-doc-sidebar-item-link theme-doc-sidebar-item-link-level-3 menu__list-item"><a class=menu__link tabindex=0 href=/zh-CN/docs/object-serialization/python/out-of-band><span title=带外序列化 class=linkLabel_WmDU>带外序列化</span></a><li class="theme-doc-sidebar-item-link theme-doc-sidebar-item-link-level-3 menu__list-item"><a class=menu__link tabindex=0 href=/zh-CN/docs/object-serialization/python/numpy-integration><span title="NumPy & Pandas" class=linkLabel_WmDU>NumPy & Pandas</span></a><li class="theme-doc-sidebar-item-link theme-doc-sidebar-item-link-level-3 menu__list-item"><a class=menu__link tabindex=0 href=/zh-CN/docs/object-serialization/python/troubleshooting><span title=故障排除 class=linkLabel_WmDU>故障排除</span></a><li class="theme-doc-sidebar-item-link theme-doc-sidebar-item-link-level-3 menu__list-item"><a class="menu__link menu__link--active" aria-current=page tabindex=0 href=/zh-CN/docs/object-serialization/python/security><span title=安全 class=linkLabel_WmDU>安全</span></a></ul><li class="theme-doc-sidebar-item-category theme-doc-sidebar-item-category-level-2 menu__list-item menu__list-item--collapsed"><div class=menu__list-item-collapsible><a class="categoryLink_byQd menu__link menu__link--sublist" tabindex=0 href=/zh-CN/docs/object-serialization/cpp/><span title=C++ class=categoryLinkLabel_W154>C++</span></a><button aria-label="展开侧边栏分类 'C++'" aria-expanded=false type=button class="clean-btn menu__caret"></button></div><li class="theme-doc-sidebar-item-category theme-doc-sidebar-item-category-level-2 menu__list-item menu__list-item--collapsed"><div class=menu__list-item-collapsible><a class="categoryLink_byQd menu__link menu__link--sublist" tabindex=0 href=/zh-CN/docs/object-serialization/go/><span title=Go class=categoryLinkLabel_W154>Go</span></a><button aria-label="展开侧边栏分类 'Go'" aria-expanded=false type=button class="clean-btn menu__caret"></button></div><li class="theme-doc-sidebar-item-category theme-doc-sidebar-item-category-level-2 menu__list-item menu__list-item--collapsed"><div class=menu__list-item-collapsible><a class="categoryLink_byQd menu__link menu__link--sublist" tabindex=0 href=/zh-CN/docs/object-serialization/rust/><span title=Rust class=categoryLinkLabel_W154>Rust</span></a><button aria-label="展开侧边栏分类 'Rust'" aria-expanded=false type=button class="clean-btn menu__caret"></button></div><li class="theme-doc-sidebar-item-category theme-doc-sidebar-item-category-level-2 menu__list-item menu__list-item--collapsed"><div class=menu__list-item-collapsible><a class="categoryLink_byQd menu__link menu__link--sublist" tabindex=0 href=/zh-CN/docs/object-serialization/javascript/><span title=JavaScript/TypeScript class=categoryLinkLabel_W154>JavaScript/TypeScript</span></a><button aria-label="展开侧边栏分类 'JavaScript/TypeScript'" aria-expanded=false type=button class="clean-btn menu__caret"></button></div><li class="theme-doc-sidebar-item-category theme-doc-sidebar-item-category-level-2 menu__list-item menu__list-item--collapsed"><div class=menu__list-item-collapsible><a class="categoryLink_byQd menu__link menu__link--sublist" tabindex=0 href=/zh-CN/docs/object-serialization/csharp/><span title=C# class=categoryLinkLabel_W154>C#</span></a><button aria-label="展开侧边栏分类 'C#'" aria-expanded=false type=button class="clean-btn menu__caret"></button></div><li class="theme-doc-sidebar-item-category theme-doc-sidebar-item-category-level-2 menu__list-item menu__list-item--collapsed"><div class=menu__list-item-collapsible><a class="categoryLink_byQd menu__link menu__link--sublist" tabindex=0 href=/zh-CN/docs/object-serialization/swift/><span title=Swift class=categoryLinkLabel_W154>Swift</span></a><button aria-label="展开侧边栏分类 'Swift'" aria-expanded=false type=button class="clean-btn menu__caret"></button></div><li class="theme-doc-sidebar-item-category theme-doc-sidebar-item-category-level-2 menu__list-item menu__list-item--collapsed"><div class=menu__list-item-collapsible><a class="categoryLink_byQd menu__link menu__link--sublist" tabindex=0 href=/zh-CN/docs/object-serialization/dart/><span title=Dart class=categoryLinkLabel_W154>Dart</span></a><button aria-label="展开侧边栏分类 'Dart'" aria-expanded=false type=button class="clean-btn menu__caret"></button></div><li class="theme-doc-sidebar-item-category theme-doc-sidebar-item-category-level-2 menu__list-item menu__list-item--collapsed"><div class=menu__list-item-collapsible><a class="categoryLink_byQd menu__link menu__link--sublist" tabindex=0 href=/zh-CN/docs/object-serialization/scala/><span title=Scala class=categoryLinkLabel_W154>Scala</span></a><button aria-label="展开侧边栏分类 'Scala'" aria-expanded=false type=button class="clean-btn menu__caret"></button></div><li class="theme-doc-sidebar-item-category theme-doc-sidebar-item-category-level-2 menu__list-item menu__list-item--collapsed"><div class=menu__list-item-collapsible><a class="categoryLink_byQd menu__link menu__link--sublist" tabindex=0 href=/zh-CN/docs/object-serialization/kotlin/><span title=Kotlin class=categoryLinkLabel_W154>Kotlin</span></a><button aria-label="展开侧边栏分类 'Kotlin'" aria-expanded=false type=button class="clean-btn menu__caret"></button></div></ul><li class="theme-doc-sidebar-item-category theme-doc-sidebar-item-category-level-1 menu__list-item menu__list-item--collapsed"><div class=menu__list-item-collapsible><a class="categoryLink_byQd menu__link menu__link--sublist menu__link--sublist-caret" role=button aria-expanded=false href=/zh-CN/docs/row-format/><span title=行格式 class=categoryLinkLabel_W154>行格式</span></a></div><li class="theme-doc-sidebar-item-category theme-doc-sidebar-item-category-level-1 menu__list-item menu__list-item--collapsed"><div class=menu__list-item-collapsible><a class="categoryLink_byQd menu__link menu__link--sublist menu__link--sublist-caret" role=button aria-expanded=false href=/zh-CN/docs/json/><span title="Fory JSON" class=categoryLinkLabel_W154>Fory JSON</span></a></div><li class="theme-doc-sidebar-item-category theme-doc-sidebar-item-category-level-1 menu__list-item menu__list-item--collapsed"><div class=menu__list-item-collapsible><a class="categoryLink_byQd menu__link menu__link--sublist menu__link--sublist-caret" role=button aria-expanded=false href=/zh-CN/docs/compiler/><span title="Fory IDL 与编译器" class=categoryLinkLabel_W154>Fory IDL 与编译器</span></a></div><li class="theme-doc-sidebar-item-category theme-doc-sidebar-item-category-level-1 menu__list-item menu__list-item--collapsed"><div class=menu__list-item-collapsible><a class="categoryLink_byQd menu__link menu__link--sublist menu__link--sublist-caret" role=button aria-expanded=false href=/zh-CN/docs/grpc/><span title="Fory gRPC" class=categoryLinkLabel_W154>Fory gRPC</span></a></div><li class="theme-doc-sidebar-item-category theme-doc-sidebar-item-category-level-1 menu__list-item menu__list-item--collapsed"><div class=menu__list-item-collapsible><a class="categoryLink_byQd menu__link menu__link--sublist menu__link--sublist-caret" role=button aria-expanded=false href=/zh-CN/docs/development/><span title=开发 class=categoryLinkLabel_W154>开发</span></a></div></ul></nav></div></div></aside><main class=docMainContainer_TBSr><div class="container padding-top--md padding-bottom--lg"><div class=row><div class="col docItemCol_VOVn"><div class=docItemContainer_Djhp><article><nav class="theme-doc-breadcrumbs breadcrumbsContainer_Z_bl" aria-label=页面路径><ul class=breadcrumbs><li class=breadcrumbs__item><a aria-label=主页面 class=breadcrumbs__link href=/zh-CN/><svg viewBox="0 0 24 24" class=breadcrumbHomeIcon_YNFT><path d="M10 19v-5h4v5c0 .55.45 1 1 1h3c.55 0 1-.45 1-1v-7h1.7c.46 0 .68-.57.33-.87L12.67 3.6c-.38-.34-.96-.34-1.34 0l-8.36 7.53c-.34.3-.13.87.33.87H5v7c0 .55.45 1 1 1h3c.55 0 1-.45 1-1z" fill=currentColor /></svg></a><li class=breadcrumbs__item><span class=breadcrumbs__link>对象序列化</span><li class=breadcrumbs__item><a class=breadcrumbs__link href=/zh-CN/docs/object-serialization/python/><span>Python</span></a><li class="breadcrumbs__item breadcrumbs__item--active"><span class=breadcrumbs__link>安全</span></ul></nav><span class="theme-doc-version-badge badge badge--secondary">版本：1.6.0</span><div class="tocCollapsible_ETCw theme-doc-toc-mobile tocMobile_ITEo"><button type=button class="clean-btn tocCollapsibleButton_TO0P">本页总览</button></div><div class="theme-doc-markdown markdown"><header><h1>安全</h1></header><p>当 Python 读取端接收来自应用信任边界之外的字节时，请遵循本页说明。Fory 会重建应用值， |
| 但不会验证发送者身份、保护传输完整性，也不会判断一个合法值是否获准用于某项业务操作。</p> |
| <h2 class="anchor anchorTargetStickyNavbar_Vzrq" id=应用边界>应用边界<a href=#应用边界 class=hash-link aria-label=应用边界的直接链接 title=应用边界的直接链接 translate=no></a></h2> |
| <p>反序列化之前：</p> |
| <ul> |
| <li class="">在传输层或存储层验证发送者身份并保护消息完整性。</li> |
| <li class="">在 Fory 外部限制请求或文件大小、超时时间和并发量。</li> |
| <li class="">只注册端点允许的应用类型，并在第一次根操作之前完成读取端配置。</li> |
| <li class="">使用反序列化结果之前，根据应用的授权规则和领域规则验证该值。</li> |
| </ul> |
| <h2 class="anchor anchorTargetStickyNavbar_Vzrq" id=内置保护>内置保护<a href=#内置保护 class=hash-link aria-label=内置保护的直接链接 title=内置保护的直接链接 translate=no></a></h2> |
| <p>应像对待不可信 pickle 字节一样对待来自不可信来源的原生模式字节。设置 <code>strict=False</code> 时，原生模式可以重建 Python 对象、导入模块、调用归约钩子以及重建动态类或函数。</p> |
| <h3 class="anchor anchorTargetStickyNavbar_Vzrq" id=生产配置>生产配置<a href=#生产配置 class=hash-link aria-label=生产配置的直接链接 title=生产配置的直接链接 translate=no></a></h3> |
| <p>生产载荷应保持 <code>strict=True</code>，除非整个数据来源都可信，并由 <code>DeserializationPolicy</code> 负责其余信任决策：</p> |
| <div class="language-python codeBlockContainer_Ckt0 theme-code-block" style=--prism-color:#393A34;--prism-background-color:#f6f8fa><div class=codeBlockContent_QJqH><pre tabindex=0 class="prism-code language-python codeBlock_bY9V thin-scrollbar" style=color:#393A34;background-color:#f6f8fa><code class=codeBlockLines_e6Vv><div class=token-line style=color:#393A34><span class="token keyword" style=color:#00009f>import</span><span class="token plain"> pyfory</span><br/></div><div class=token-line style=color:#393A34><span class="token plain" style=display:inline-block></span><br/></div><div class=token-line style=color:#393A34><span class="token plain">fory </span><span class="token operator" style=color:#393A34>=</span><span class="token plain"> pyfory</span><span class="token punctuation" style=color:#393A34>.</span><span class="token plain">Fory</span><span class="token punctuation" style=color:#393A34>(</span><span class="token plain"></span><br/></div><div class=token-line style=color:#393A34><span class="token plain"> xlang</span><span class="token operator" style=color:#393A34>=</span><span class="token boolean" style=color:#36acaa>True</span><span class="token punctuation" style=color:#393A34>,</span><span class="token plain"></span><br/></div><div class=token-line style=color:#393A34><span class="token plain"> ref</span><span class="token operator" style=color:#393A34>=</span><span class="token boolean" style=color:#36acaa>False</span><span class="token punctuation" style=color:#393A34>,</span><span class="token plain"></span><br/></div><div class=token-line style=color:#393A34><span class="token plain"> strict</span><span class="token operator" style=color:#393A34>=</span><span class="token boolean" style=color:#36acaa>True</span><span class="token punctuation" style=color:#393A34>,</span><span class="token plain"></span><br/></div><div class=token-line style=color:#393A34><span class="token plain"> max_depth</span><span class="token operator" style=color:#393A34>=</span><span class="token number" style=color:#36acaa>50</span><span class="token punctuation" style=color:#393A34>,</span><span class="token plain"></span><br/></div><div class=token-line style=color:#393A34><span class="token plain"> max_type_fields</span><span class="token operator" style=color:#393A34>=</span><span class="token number" style=color:#36acaa>512</span><span class="token punctuation" style=color:#393A34>,</span><span class="token plain"></span><br/></div><div class=token-line style=color:#393A34><span class="token plain"> max_type_meta_bytes</span><span class="token operator" style=color:#393A34>=</span><span class="token number" style=color:#36acaa>4096</span><span class="token punctuation" style=color:#393A34>,</span><span class="token plain"></span><br/></div><div class=token-line style=color:#393A34><span class="token plain"> max_schema_versions_per_type</span><span class="token operator" style=color:#393A34>=</span><span class="token number" style=color:#36acaa>10</span><span class="token punctuation" style=color:#393A34>,</span><span class="token plain"></span><br/></div><div class=token-line style=color:#393A34><span class="token plain"> max_average_schema_versions_per_type</span><span class="token operator" style=color:#393A34>=</span><span class="token number" style=color:#36acaa>3</span><span class="token punctuation" style=color:#393A34>,</span><span class="token plain"></span><br/></div><div class=token-line style=color:#393A34><span class="token plain"> max_graph_memory_bytes</span><span class="token operator" style=color:#393A34>=</span><span class="token number" style=color:#36acaa>128</span><span class="token plain"> </span><span class="token operator" style=color:#393A34>*</span><span class="token plain"> </span><span class="token number" style=color:#36acaa>1024</span><span class="token plain"> </span><span class="token operator" style=color:#393A34>*</span><span class="token plain"> </span><span class="token number" style=color:#36acaa>1024</span><span class="token punctuation" style=color:#393A34>,</span><span class="token plain"></span><br/></div><div class=token-line style=color:#393A34><span class="token plain"></span><span class="token punctuation" style=color:#393A34>)</span><span class="token plain"></span><br/></div><div class=token-line style=color:#393A34><span class="token plain" style=display:inline-block></span><br/></div><div class=token-line style=color:#393A34><span class="token plain">fory</span><span class="token punctuation" style=color:#393A34>.</span><span class="token plain">register</span><span class="token punctuation" style=color:#393A34>(</span><span class="token plain">UserModel</span><span class="token punctuation" style=color:#393A34>,</span><span class="token plain"> name</span><span class="token operator" style=color:#393A34>=</span><span class="token string" style=color:#e3116c>"example.User"</span><span class="token punctuation" style=color:#393A34>)</span><span class="token plain"></span><br/></div><div class=token-line style=color:#393A34><span class="token plain">fory</span><span class="token punctuation" style=color:#393A34>.</span><span class="token plain">register</span><span class="token punctuation" style=color:#393A34>(</span><span class="token plain">OrderModel</span><span class="token punctuation" style=color:#393A34>,</span><span class="token plain"> name</span><span class="token operator" style=color:#393A34>=</span><span class="token string" style=color:#e3116c>"example.Order"</span><span class="token punctuation" style=color:#393A34>)</span><br/></div></code></pre></div></div> |
| <p>仅对可信的仅限 Python 载荷使用动态原生模式反序列化（<code>strict=False</code>）：</p> |
| <div class="language-python codeBlockContainer_Ckt0 theme-code-block" style=--prism-color:#393A34;--prism-background-color:#f6f8fa><div class=codeBlockContent_QJqH><pre tabindex=0 class="prism-code language-python codeBlock_bY9V thin-scrollbar" style=color:#393A34;background-color:#f6f8fa><code class=codeBlockLines_e6Vv><div class=token-line style=color:#393A34><span class="token keyword" style=color:#00009f>import</span><span class="token plain"> pyfory</span><br/></div><div class=token-line style=color:#393A34><span class="token plain" style=display:inline-block></span><br/></div><div class=token-line style=color:#393A34><span class="token plain">fory </span><span class="token operator" style=color:#393A34>=</span><span class="token plain"> pyfory</span><span class="token punctuation" style=color:#393A34>.</span><span class="token plain">Fory</span><span class="token punctuation" style=color:#393A34>(</span><span class="token plain"></span><br/></div><div class=token-line style=color:#393A34><span class="token plain"> xlang</span><span class="token operator" style=color:#393A34>=</span><span class="token boolean" style=color:#36acaa>False</span><span class="token punctuation" style=color:#393A34>,</span><span class="token plain"></span><br/></div><div class=token-line style=color:#393A34><span class="token plain"> ref</span><span class="token operator" style=color:#393A34>=</span><span class="token boolean" style=color:#36acaa>True</span><span class="token punctuation" style=color:#393A34>,</span><span class="token plain"></span><br/></div><div class=token-line style=color:#393A34><span class="token plain"> strict</span><span class="token operator" style=color:#393A34>=</span><span class="token boolean" style=color:#36acaa>False</span><span class="token punctuation" style=color:#393A34>,</span><span class="token plain"></span><br/></div><div class=token-line style=color:#393A34><span class="token plain"> max_depth</span><span class="token operator" style=color:#393A34>=</span><span class="token number" style=color:#36acaa>100</span><span class="token punctuation" style=color:#393A34>,</span><span class="token plain"></span><br/></div><div class=token-line style=color:#393A34><span class="token plain"></span><span class="token punctuation" style=color:#393A34>)</span><br/></div></code></pre></div></div> |
| <p>接收的远程元数据也受到限制：</p> |
| <ul> |
| <li class=""><code>max_type_fields</code> 限制单个已接收结构体元数据正文可接受的字段数。</li> |
| <li class=""><code>max_type_meta_bytes</code> 限制单个已接收 TypeDef 正文可接受的编码正文字节数。</li> |
| <li class=""><code>max_schema_versions_per_type</code> 限制每个逻辑类型可接受的远程元数据版本。</li> |
| <li class=""><code>max_average_schema_versions_per_type</code> 限制所有已接受远程类型的平均值。</li> |
| <li class=""><code>max_graph_memory_bytes</code> 为单次根反序列化期间实例化的对象图内存设置近似门限。估算主要覆盖列表、元组、集合、字典、对象数组、结构体和 Python 对象。它会跳过字符串、二进制数据、原始标量和稠密原始类型数组等叶子值，因此实际进程内存可能高于该值。叶子值仍受字节可用性检查保护：如果未读取的输入没有足够字节，Fory 不会读取或创建该叶子值。所有根输入形式的默认值固定为 <code>128 MiB</code>。可信载荷确实需要更大或更小门限时，请设置正数字节值。</li> |
| <li class=""><code>max_unbacked_container_items</code> 限制单次根反序列化中重复读取正文没有消耗相应输入的集合元素和映射条目。默认值为 <code>8192</code>；零表示严格限制。</li> |
| </ul> |
| <p>这些限制不会改变 <code>strict</code>、<code>policy</code>、动态加载、未知类处理或 Schema 演进语义。</p> |
| <h3 class="anchor anchorTargetStickyNavbar_Vzrq" id=deserializationpolicy>DeserializationPolicy<a href=#deserializationpolicy class=hash-link aria-label=DeserializationPolicy的直接链接 title=DeserializationPolicy的直接链接 translate=no></a></h3> |
| <p>必须使用 <code>strict=False</code> 时，请使用 <code>DeserializationPolicy</code> 限制反序列化期间接受的动态类型和钩子：</p> |
| <div class="language-python codeBlockContainer_Ckt0 theme-code-block" style=--prism-color:#393A34;--prism-background-color:#f6f8fa><div class=codeBlockContent_QJqH><pre tabindex=0 class="prism-code language-python codeBlock_bY9V thin-scrollbar" style=color:#393A34;background-color:#f6f8fa><code class=codeBlockLines_e6Vv><div class=token-line style=color:#393A34><span class="token keyword" style=color:#00009f>import</span><span class="token plain"> pyfory</span><br/></div><div class=token-line style=color:#393A34><span class="token plain"></span><span class="token keyword" style=color:#00009f>from</span><span class="token plain"> pyfory </span><span class="token keyword" style=color:#00009f>import</span><span class="token plain"> DeserializationPolicy</span><br/></div><div class=token-line style=color:#393A34><span class="token plain" style=display:inline-block></span><br/></div><div class=token-line style=color:#393A34><span class="token plain">dangerous_modules </span><span class="token operator" style=color:#393A34>=</span><span class="token plain"> </span><span class="token punctuation" style=color:#393A34>{</span><span class="token string" style=color:#e3116c>"subprocess"</span><span class="token punctuation" style=color:#393A34>,</span><span class="token plain"> </span><span class="token string" style=color:#e3116c>"os"</span><span class="token punctuation" style=color:#393A34>,</span><span class="token plain"> </span><span class="token string" style=color:#e3116c>"__builtin__"</span><span class="token punctuation" style=color:#393A34>}</span><span class="token plain"></span><br/></div><div class=token-line style=color:#393A34><span class="token plain" style=display:inline-block></span><br/></div><div class=token-line style=color:#393A34><span class="token plain"></span><span class="token keyword" style=color:#00009f>class</span><span class="token plain"> </span><span class="token class-name">SafeDeserializationPolicy</span><span class="token punctuation" style=color:#393A34>(</span><span class="token plain">DeserializationPolicy</span><span class="token punctuation" style=color:#393A34>)</span><span class="token punctuation" style=color:#393A34>:</span><span class="token plain"></span><br/></div><div class=token-line style=color:#393A34><span class="token plain"> </span><span class="token keyword" style=color:#00009f>def</span><span class="token plain"> </span><span class="token function" style=color:#d73a49>validate_class</span><span class="token punctuation" style=color:#393A34>(</span><span class="token plain">self</span><span class="token punctuation" style=color:#393A34>,</span><span class="token plain"> cls</span><span class="token punctuation" style=color:#393A34>,</span><span class="token plain"> is_local</span><span class="token punctuation" style=color:#393A34>,</span><span class="token plain"> </span><span class="token operator" style=color:#393A34>**</span><span class="token plain">kwargs</span><span class="token punctuation" style=color:#393A34>)</span><span class="token punctuation" style=color:#393A34>:</span><span class="token plain"></span><br/></div><div class=token-line style=color:#393A34><span class="token plain"> </span><span class="token keyword" style=color:#00009f>if</span><span class="token plain"> cls</span><span class="token punctuation" style=color:#393A34>.</span><span class="token plain">__module__ </span><span class="token keyword" style=color:#00009f>in</span><span class="token plain"> dangerous_modules</span><span class="token punctuation" style=color:#393A34>:</span><span class="token plain"></span><br/></div><div class=token-line style=color:#393A34><span class="token plain"> </span><span class="token keyword" style=color:#00009f>raise</span><span class="token plain"> ValueError</span><span class="token punctuation" style=color:#393A34>(</span><span class="token string-interpolation string" style=color:#e3116c>f"Blocked dangerous class: </span><span class="token string-interpolation interpolation punctuation" style=color:#393A34>{</span><span class="token string-interpolation interpolation">cls</span><span class="token string-interpolation interpolation punctuation" style=color:#393A34>.</span><span class="token string-interpolation interpolation">__module__</span><span class="token string-interpolation interpolation punctuation" style=color:#393A34>}</span><span class="token string-interpolation string" style=color:#e3116c>.</span><span class="token string-interpolation interpolation punctuation" style=color:#393A34>{</span><span class="token string-interpolation interpolation">cls</span><span class="token string-interpolation interpolation punctuation" style=color:#393A34>.</span><span class="token string-interpolation interpolation">__name__</span><span class="token string-interpolation interpolation punctuation" style=color:#393A34>}</span><span class="token string-interpolation string" style=color:#e3116c>"</span><span class="token punctuation" style=color:#393A34>)</span><span class="token plain"></span><br/></div><div class=token-line style=color:#393A34><span class="token plain" style=display:inline-block></span><br/></div><div class=token-line style=color:#393A34><span class="token plain"> </span><span class="token keyword" style=color:#00009f>def</span><span class="token plain"> </span><span class="token function" style=color:#d73a49>intercept_reduce_call</span><span class="token punctuation" style=color:#393A34>(</span><span class="token plain">self</span><span class="token punctuation" style=color:#393A34>,</span><span class="token plain"> callable_obj</span><span class="token punctuation" style=color:#393A34>,</span><span class="token plain"> args</span><span class="token punctuation" style=color:#393A34>,</span><span class="token plain"> </span><span class="token operator" style=color:#393A34>**</span><span class="token plain">kwargs</span><span class="token punctuation" style=color:#393A34>)</span><span class="token punctuation" style=color:#393A34>:</span><span class="token plain"></span><br/></div><div class=token-line style=color:#393A34><span class="token plain"> </span><span class="token keyword" style=color:#00009f>if</span><span class="token plain"> </span><span class="token builtin">getattr</span><span class="token punctuation" style=color:#393A34>(</span><span class="token plain">callable_obj</span><span class="token punctuation" style=color:#393A34>,</span><span class="token plain"> </span><span class="token string" style=color:#e3116c>"__name__"</span><span class="token punctuation" style=color:#393A34>,</span><span class="token plain"> </span><span class="token string" style=color:#e3116c>""</span><span class="token punctuation" style=color:#393A34>)</span><span class="token plain"> </span><span class="token operator" style=color:#393A34>==</span><span class="token plain"> </span><span class="token string" style=color:#e3116c>"Popen"</span><span class="token punctuation" style=color:#393A34>:</span><span class="token plain"></span><br/></div><div class=token-line style=color:#393A34><span class="token plain"> </span><span class="token keyword" style=color:#00009f>raise</span><span class="token plain"> ValueError</span><span class="token punctuation" style=color:#393A34>(</span><span class="token string" style=color:#e3116c>"Blocked attempt to invoke subprocess.Popen"</span><span class="token punctuation" style=color:#393A34>)</span><span class="token plain"></span><br/></div><div class=token-line style=color:#393A34><span class="token plain"> </span><span class="token keyword" style=color:#00009f>return</span><span class="token plain"> </span><span class="token boolean" style=color:#36acaa>None</span><span class="token plain"></span><br/></div><div class=token-line style=color:#393A34><span class="token plain" style=display:inline-block></span><br/></div><div class=token-line style=color:#393A34><span class="token plain"> </span><span class="token keyword" style=color:#00009f>def</span><span class="token plain"> </span><span class="token function" style=color:#d73a49>intercept_setstate</span><span class="token punctuation" style=color:#393A34>(</span><span class="token plain">self</span><span class="token punctuation" style=color:#393A34>,</span><span class="token plain"> obj</span><span class="token punctuation" style=color:#393A34>,</span><span class="token plain"> state</span><span class="token punctuation" style=color:#393A34>,</span><span class="token plain"> </span><span class="token operator" style=color:#393A34>**</span><span class="token plain">kwargs</span><span class="token punctuation" style=color:#393A34>)</span><span class="token punctuation" style=color:#393A34>:</span><span class="token plain"></span><br/></div><div class=token-line style=color:#393A34><span class="token plain"> </span><span class="token keyword" style=color:#00009f>if</span><span class="token plain"> </span><span class="token builtin">isinstance</span><span class="token punctuation" style=color:#393A34>(</span><span class="token plain">state</span><span class="token punctuation" style=color:#393A34>,</span><span class="token plain"> </span><span class="token builtin">dict</span><span class="token punctuation" style=color:#393A34>)</span><span class="token plain"> </span><span class="token keyword" style=color:#00009f>and</span><span class="token plain"> </span><span class="token string" style=color:#e3116c>"password"</span><span class="token plain"> </span><span class="token keyword" style=color:#00009f>in</span><span class="token plain"> state</span><span class="token punctuation" style=color:#393A34>:</span><span class="token plain"></span><br/></div><div class=token-line style=color:#393A34><span class="token plain"> state</span><span class="token punctuation" style=color:#393A34>[</span><span class="token string" style=color:#e3116c>"password"</span><span class="token punctuation" style=color:#393A34>]</span><span class="token plain"> </span><span class="token operator" style=color:#393A34>=</span><span class="token plain"> </span><span class="token string" style=color:#e3116c>"***REDACTED***"</span><span class="token plain"></span><br/></div><div class=token-line style=color:#393A34><span class="token plain"> </span><span class="token keyword" style=color:#00009f>return</span><span class="token plain"> </span><span class="token boolean" style=color:#36acaa>None</span><span class="token plain"></span><br/></div><div class=token-line style=color:#393A34><span class="token plain" style=display:inline-block></span><br/></div><div class=token-line style=color:#393A34><span class="token plain">policy </span><span class="token operator" style=color:#393A34>=</span><span class="token plain"> SafeDeserializationPolicy</span><span class="token punctuation" style=color:#393A34>(</span><span class="token punctuation" style=color:#393A34>)</span><span class="token plain"></span><br/></div><div class=token-line style=color:#393A34><span class="token plain">fory </span><span class="token operator" style=color:#393A34>=</span><span class="token plain"> pyfory</span><span class="token punctuation" style=color:#393A34>.</span><span class="token plain">Fory</span><span class="token punctuation" style=color:#393A34>(</span><span class="token plain">xlang</span><span class="token operator" style=color:#393A34>=</span><span class="token boolean" style=color:#36acaa>False</span><span class="token punctuation" style=color:#393A34>,</span><span class="token plain"> ref</span><span class="token operator" style=color:#393A34>=</span><span class="token boolean" style=color:#36acaa>True</span><span class="token punctuation" style=color:#393A34>,</span><span class="token plain"> strict</span><span class="token operator" style=color:#393A34>=</span><span class="token boolean" style=color:#36acaa>False</span><span class="token punctuation" style=color:#393A34>,</span><span class="token plain"> policy</span><span class="token operator" style=color:#393A34>=</span><span class="token plain">policy</span><span class="token punctuation" style=color:#393A34>)</span><br/></div></code></pre></div></div> |
| <p>可用的策略钩子包括：</p> |
| <p>引用验证钩子通过抛出异常拒绝输入；不拒绝时，保持反序列化后的引用不变。</p> |
| <table><thead><tr><th>钩子<th>说明<tbody><tr><td><code>validate_class(cls, is_local)</code><td>验证或阻止类类型<tr><td><code>validate_module(module_name, is_local)</code><td>验证或阻止模块导入<tr><td><code>validate_function(func, is_local)</code><td>验证或阻止函数引用<tr><td><code>validate_method(method, is_local)</code><td>验证或阻止方法引用<tr><td><code>intercept_reduce_call(callable_obj, args)</code><td>拦截 <code>__reduce__</code> 调用<tr><td><code>inspect_reduced_object(obj)</code><td>检查或替换通过 <code>__reduce__</code> 创建的对象<tr><td><code>intercept_setstate(obj, state)</code><td>在 <code>__setstate__</code> 前清理状态<tr><td><code>authorize_instantiation(cls, args, kwargs)</code><td>控制类实例化</table> |
| <h3 class="anchor anchorTargetStickyNavbar_Vzrq" id=安全检查清单>安全检查清单<a href=#安全检查清单 class=hash-link aria-label=安全检查清单的直接链接 title=安全检查清单的直接链接 translate=no></a></h3> |
| <ul> |
| <li class="">对不可信数据保持 <code>strict=True</code>。</li> |
| <li class="">反序列化前注册所有预期的应用类型。</li> |
| <li class="">使用 <code>DeserializationPolicy</code> 约束必须设置 <code>strict=False</code> 的场景。</li> |
| <li class="">将 <code>max_depth</code> 保持在足以拒绝异常深度载荷的较低值。</li> |
| <li class="">对多数输入，将 <code>max_graph_memory_bytes</code> 保持为固定的 <code>128 MiB</code> 默认值；对于合法集合/映射/结构体大小不同的可信工作负载，则设置显式正数门限。</li> |
| <li class="">不要将跨语言/原生模式选择视为安全控制。</li> |
| </ul> |
| <h2 class="anchor anchorTargetStickyNavbar_Vzrq" id=验证>验证<a href=#验证 class=hash-link aria-label=验证的直接链接 title=验证的直接链接 translate=no></a></h2> |
| <p>除正常往返测试外，还应为边界添加负向测试。确认配置后的读取端会拒绝意外的应用类型、 |
| 过深的嵌套、超出资源限制的输入以及格式错误的输入。一次读取失败后，还应确认同一 Fory 实例 |
| 仍能正确读取下一个合法根值。</p> |
| <p>完整选项请参阅<a class="" href=/zh-CN/docs/object-serialization/python/configuration>配置</a>，Fory 注册 API 请参阅<a class="" href=/zh-CN/docs/object-serialization/python/type-registration>类型注册</a>。</div><footer class="theme-doc-footer docusaurus-mt-lg"><div class="row margin-top--sm theme-doc-footer-edit-meta-row"><div class="col noPrint_WFHX"><a href=https://github.com/apache/fory-site/tree/main/i18n/zh-CN/docusaurus-plugin-content-docs/version-1.6.0/object-serialization/python/security.md target=_blank rel="noopener noreferrer" class=theme-edit-this-page><svg fill=currentColor height=20 width=20 viewBox="0 0 40 40" class=iconEdit_Z9Sw aria-hidden=true><g><path d="m34.5 11.7l-3 3.1-6.3-6.3 3.1-3q0.5-0.5 1.2-0.5t1.1 0.5l3.9 3.9q0.5 0.4 0.5 1.1t-0.5 1.2z m-29.5 17.1l18.4-18.5 6.3 6.3-18.4 18.4h-6.3v-6.2z"/></g></svg>编辑此页</a></div><div class="col lastUpdated_JAkA"></div></div></footer></article><nav class="docusaurus-mt-lg pagination-nav" aria-label=文件选项卡><a class="pagination-nav__link pagination-nav__link--prev" href=/zh-CN/docs/object-serialization/python/troubleshooting><div class=pagination-nav__sublabel>上一页</div><div class=pagination-nav__label>故障排除</div></a><a class="pagination-nav__link pagination-nav__link--next" href=/zh-CN/docs/object-serialization/cpp/><div class=pagination-nav__sublabel>下一页</div><div class=pagination-nav__label>C++ 对象序列化</div></a></nav></div></div><div class="col col--3"><div class="tableOfContents_bqdL thin-scrollbar theme-doc-toc-desktop"><ul class="table-of-contents table-of-contents__left-border"><li><a href=#应用边界 class="table-of-contents__link toc-highlight">应用边界</a><li><a href=#内置保护 class="table-of-contents__link toc-highlight">内置保护</a><ul><li><a href=#生产配置 class="table-of-contents__link toc-highlight">生产配置</a><li><a href=#deserializationpolicy class="table-of-contents__link toc-highlight">DeserializationPolicy</a><li><a href=#安全检查清单 class="table-of-contents__link toc-highlight">安全检查清单</a></ul><li><a href=#验证 class="table-of-contents__link toc-highlight">验证</a></ul></div></div></div></div></main></div></div></div><footer class="theme-layout-footer footer footer--dark"><div class="container container-fluid"><div class="row footer__links"><div class="theme-layout-footer-column col footer__col"><div class=footer__title>社区</div><ul class="footer__items clean-list"><li class=footer__item><a href=https://lists.apache.org/list.html?dev@fory.apache.org target=_blank rel="noopener noreferrer" class=footer__link-item>邮件列表<svg width=13.5 height=13.5 aria-label="(opens in new tab)" class=iconExternalLink_nPIU><use href=#theme-svg-external-link /></svg></a><li class=footer__item><a href=https://join.slack.com/t/fory-project/shared_invite/zt-1u8soj4qc-ieYEu7ciHOqA2mo47llS8A target=_blank rel="noopener noreferrer" class=footer__link-item>Slack<svg width=13.5 height=13.5 aria-label="(opens in new tab)" class=iconExternalLink_nPIU><use href=#theme-svg-external-link /></svg></a><li class=footer__item><a href=https://twitter.com/ApacheFory target=_blank rel="noopener noreferrer" class=footer__link-item>Twitter<svg width=13.5 height=13.5 aria-label="(opens in new tab)" class=iconExternalLink_nPIU><use href=#theme-svg-external-link /></svg></a></ul></div><div class="theme-layout-footer-column col footer__col"><div class=footer__title>文档</div><ul class="footer__items clean-list"><li class=footer__item><a class=footer__link-item href=/zh-CN/docs/start/>安装</a><li class=footer__item><a class=footer__link-item href=/zh-CN/docs/start/>使用</a><li class=footer__item><a class=footer__link-item href=/zh-CN/docs/benchmarks/>基准测试</a></ul></div><div class="theme-layout-footer-column col footer__col"><div class=footer__title>代码库</div><ul class="footer__items clean-list"><li class=footer__item><a href=https://github.com/apache/fory target=_blank rel="noopener noreferrer" class=footer__link-item>Apache Fory™<svg width=13.5 height=13.5 aria-label="(opens in new tab)" class=iconExternalLink_nPIU><use href=#theme-svg-external-link /></svg></a><li class=footer__item><a href=https://github.com/apache/fory-site target=_blank rel="noopener noreferrer" class=footer__link-item>网站<svg width=13.5 height=13.5 aria-label="(opens in new tab)" class=iconExternalLink_nPIU><use href=#theme-svg-external-link /></svg></a></ul></div></div><div class="footer__bottom text--center"><div class=margin-bottom--sm><a href=https://apache.org/ rel="noopener noreferrer" class=footerLogoLink_BH7S><img src=/zh-CN/img/asf_logo.svg alt="Apache Incubator 标志" class="footer__logo themedComponent_mlkZ themedComponent--light_NVdE" width=200 /><img src=/zh-CN/img/asf_logo.svg alt="Apache Incubator 标志" class="footer__logo themedComponent_mlkZ themedComponent--dark_xIcU" width=200 /></a></div><div class=footer__copyright><div> |
| <p> 版权所有 © 2025 The Apache Software Foundation，许可证：Apache License, Version 2.0。 <br/> |
| Apache Fory、Fory、Apache、Apache Logo、Apache Fory Logo 是 Apache 软件基金会在美国和/或其他国家的注册商标或商标。 |
| </p> |
| </div></div></div></div></footer></div></body> |
