Arbitrary data being unpickled may allow code execution

[frgtn]

RedisBackend tries to unpickle data it receives from redis without checking any signatures. This is a potential security issue: an adversary with access to the redis server could perform a code execution attack on application servers running beaker_redis code.

Generally a good way is to either sign the pickled data with a secret key and then check signature before unpickling or use a serialization format such as JSON or msgpack.

Beaker can already sign (and encrypt) session data but this is now being bypassed at the backend level.

[zzzsochi]

Yes, it's a security issue.
I do not need it. If you want, you can implement and create a pull request, but it should be disablable.