Unsafe Deserialization with Pickle

1import pickle
2import base64
3
4def load_user_preferences(encoded_data):
5    # Deserialize user preferences from cookie
6    data = base64.b64decode(encoded_data)
7    preferences = pickle.loads(data)
8    return preferences
9
10@app.route('/preferences', methods=['POST'])
11def update_preferences():
12    prefs_cookie = request.cookies.get('preferences')
13    if prefs_cookie:
14        preferences = load_user_preferences(prefs_cookie)
15        # Apply user preferences
16        apply_theme(preferences.get('theme'))
17        set_language(preferences.get('language'))
18    return jsonify({'success': True})