sqlmapproject/sqlmap · error · ValueError

deserialization of class '%s' is forbidden

Error message

deserialization of class '%s' is forbidden

What it means

Error "deserialization of class '%s' is forbidden" thrown in sqlmapproject/sqlmap.

Source

Thrown at lib/core/convert.py:231

            return datetime.time(*struct["v"])
        elif tag == "td":
            return datetime.timedelta(struct["v"][0], struct["v"][1], struct["v"][2])
        elif tag == "o":
            return _serializeDecodeObject(struct)
        elif tag is None:  # defensive - a bare mapping should never occur
            return dict((_serializeDecode(k), _serializeDecode(v)) for (k, v) in struct.items())
        else:
            raise ValueError("unsupported serialized tag '%s'" % tag)

    raise ValueError("unsupported serialized structure of type '%s'" % type(struct))

def _serializeResolveClass(name):
    """
    Resolves an allowlisted class name to its class (nothing else may be reconstructed)
    """

    if name not in _SERIALIZE_CLASSES:
        raise ValueError("deserialization of class '%s' is forbidden" % name)

    if name == "lib.utils.har.RawPair":
        from lib.utils.har import RawPair
        return RawPair
    else:
        from lib.core.datatype import AttribDict, InjectionDict
        return InjectionDict if name.endswith("InjectionDict") else AttribDict

def _serializeDecodeObject(struct):
    """
    Reconstructs an allowlisted class instance from its serialized form
    """

    _class = _serializeResolveClass(struct.get("c"))
    retVal = _class.__new__(_class)

    if isinstance(retVal, dict):
        for pair in (struct.get("d") or []):

View on GitHub (pinned to 0a35b20e39)

When it happens

Trigger: Thrown at lib/core/convert.py:231 when the library encounters an invalid state.

Common situations: See trigger scenarios.

Understand the failure class

AI-assisted analysis of sqlmapproject/sqlmap@0a35b20e39 (2026-08-26). Data as JSON: /api/errors/5b5afe64d7f6ce18. Report an issue: GitHub.