{"record":{"id":"5b5afe64d7f6ce18","repo":"sqlmapproject/sqlmap","slug":"deserialization-of-class-s-is-forbidden","errorCode":null,"errorMessage":"deserialization of class '%s' is forbidden","messagePattern":"deserialization of class '(.+?)' is forbidden","errorType":"exception","errorClass":"ValueError","httpStatus":null,"severity":"error","filePath":"lib/core/convert.py","lineNumber":231,"sourceCode":"            return datetime.time(*struct[\"v\"])\n        elif tag == \"td\":\n            return datetime.timedelta(struct[\"v\"][0], struct[\"v\"][1], struct[\"v\"][2])\n        elif tag == \"o\":\n            return _serializeDecodeObject(struct)\n        elif tag is None:  # defensive - a bare mapping should never occur\n            return dict((_serializeDecode(k), _serializeDecode(v)) for (k, v) in struct.items())\n        else:\n            raise ValueError(\"unsupported serialized tag '%s'\" % tag)\n\n    raise ValueError(\"unsupported serialized structure of type '%s'\" % type(struct))\n\ndef _serializeResolveClass(name):\n    \"\"\"\n    Resolves an allowlisted class name to its class (nothing else may be reconstructed)\n    \"\"\"\n\n    if name not in _SERIALIZE_CLASSES:\n        raise ValueError(\"deserialization of class '%s' is forbidden\" % name)\n\n    if name == \"lib.utils.har.RawPair\":\n        from lib.utils.har import RawPair\n        return RawPair\n    else:\n        from lib.core.datatype import AttribDict, InjectionDict\n        return InjectionDict if name.endswith(\"InjectionDict\") else AttribDict\n\ndef _serializeDecodeObject(struct):\n    \"\"\"\n    Reconstructs an allowlisted class instance from its serialized form\n    \"\"\"\n\n    _class = _serializeResolveClass(struct.get(\"c\"))\n    retVal = _class.__new__(_class)\n\n    if isinstance(retVal, dict):\n        for pair in (struct.get(\"d\") or []):","sourceCodeStart":213,"sourceCodeEnd":249,"githubUrl":"https://github.com/sqlmapproject/sqlmap/blob/0a35b20e3953d341be6c7ac75ccb0b3362540c8d/lib/core/convert.py#L213-L249","documentation":"Error \"deserialization of class '%s' is forbidden\" thrown in sqlmapproject/sqlmap.","triggerScenarios":"Thrown at lib/core/convert.py:231 when the library encounters an invalid state.","commonSituations":"See trigger scenarios.","solutions":[],"exampleFix":null,"handlingStrategy":null,"validationCode":null,"typeGuard":null,"tryCatchPattern":null,"preventionTips":[],"tags":[],"backgroundTag":null,"analyzedSha":"0a35b20e3953d341be6c7ac75ccb0b3362540c8d","analyzedAt":"2026-08-26T23:02:52.002Z","schemaVersion":2},"datasetVersion":"2026-08-27T03:17:27.898Z"}