[Security] Fix CodeQL alert #36: Deserialization of user-controlled data

[colin-d-fried]

Summary

Fixes CodeQL alert #36: Deserialization of user-controlled data

Field	Value
Severity	critical
File	vulnerable_deserialization.py
CWE	CWE-502
Alert	CodeQL Alert #36

Fix Applied

See the diff for the specific secure coding change applied.

Fixes #38

---

---

Note

Medium Risk
Changes the /import upload path from pickle.loads to json.loads, which is safer but may break existing clients that were uploading pickled payloads or non-JSON data.

Overview
Removes unsafe deserialization of uploaded data in the /import endpoint by replacing pickle.loads(content) with JSON parsing via json.loads(content).

This mitigates the CodeQL-reported CWE-502 issue, but also changes the accepted import format to JSON-only for that route.

^{Written by Cursor Bugbot for commit 8dad926. This will update automatically on new commits. Configure here.}

[devin-ai-integration]

✅ Devin Review: No Issues Found

Devin Review analyzed this PR and found no potential bugs to report.

View in Devin Review to see 2 additional findings.

[cursor]

Cursor Bugbot has reviewed your changes and found 1 potential issue.

^{Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, enable autofix in the Cursor dashboard.}

[cursor]

Unnecessary inline import with unconventional private alias

Low Severity

The json module is imported inside the function body with an unnecessary underscore-prefixed alias (_json). There is no naming conflict with json in this scope, making the alias pointless and misleading (the underscore prefix conventionally denotes a private/internal name). The import also belongs at the module level alongside pickle, yaml, and marshal rather than being repeated on every call to import_data.