Is marshal.loads a safer alternative to pickle.loads for untrusted bytes?

## Why anyone asks `marshal` looks like the safe cousin of `pickle`. It has the same `dumps` / `loads` shape, it is fast, and — unlike pickle — it genuinely cannot be made to import a module of the payload's choosing or call a constructor you did not expect. It handles a fixed set of built-in types: `None`, booleans, integers, floats, complex numbers, `str`, `bytes`, tuples, lists, dictionaries, sets, frozensets, and code objects. There is no `REDUCE`-style opcode and no `__reduce__` hook. So the reasoning goes: no arbitrary calls, therefore safe for untrusted input. The answer is still no, for reasons that have nothing to do with pickle's opcode machine. ## What marshal is for `marshal` is CPython's *internal* serialization format. Its main job is the body of a `.pyc` file: when the interpreter caches compiled bytecode, the code object is written with marshal and read back with marshal. The documentation states plainly that the format is undocumented, that it is not intended to be stable between Python versions, and that it is **not intended to be secure against erroneous or maliciously constructed data**, with an explicit instruction never to unmarshal data from an untrusted or unauthenticated source. That first pair of properties alone disqualifies it as a data-interchange format even ignoring security. Bytes written by one release may be unreadable by the next, so anything you persist with it is coupled to the interpreter that wrote it. `marshal.version` reflects the current format revision, and it has changed across releases. ## The two real hazards **Code objects.** Marshal can carry a code object, so a payload can hand you compiled bytecode. Loading it does not by itself run anything — this is the nuance to get right, because it is routinely stated wrongly in both directions. What makes it dangerous is what a program naturally does next: an object of that kind exists to be executed, and any code path that passes it to `exec`, wraps it in a function, or hands it to an import machinery hook runs whatever the producer compiled. A loader-shaped program that unmarshals and executes is the entire mechanism of `.pyc` loading, which is why a writable bytecode cache is a code-execution path on any interpreter. **The reader itself.** The parser is written on the assumption that it is reading bytes CPython wrote. Type codes, lengths and back-references are taken largely at face value, and hostile input aimed at that reader has historically produced crashes rather than clean exceptions. There is no promise of a well-behaved failure, which is exactly what the documentation's warning is telling you. ## What `allow_code` did and did not add Python 3.13 added an `allow_code` parameter to `marshal.dumps` and `marshal.loads`, still present in 3.14. It defaults to true; passing `allow_code=False` makes the functions refuse to serialize or deserialize code objects, raising `ValueError`. Understand what motivated it: cross-version portability. If you use marshal for simple data structures, refusing code objects means you cannot accidentally embed something whose format is tied to one interpreter version. It is a compatibility guard that happens to remove the most obviously dangerous type, and it is worth setting on any load you cannot avoid. It does not make the module a hardened parser, it does not address malformed input aimed at the reader, and it does not turn marshal into a format you should accept from strangers. ## What to say instead For data crossing a trust boundary, use a data-only format with an independent, hardened parser — JSON is the usual answer — and construct your objects from the parsed primitives with a function you wrote. If you need compactness, a schema-checked binary format with a real parser is the right category. Neither pickle nor marshal belongs on that boundary, and swapping one for the other is a lateral move, not a fix. For data moving between components you control, the question is authentication rather than parsing: sign the bytes with an HMAC keyed from a secret store and verify before loading. That is the same answer as for pickle, because it is the same problem. The interview point is smaller than the explanation: candidates reach for marshal because it is "lower level", assuming lower level means simpler and simpler means safer. Here it means the opposite. Lower level means the parser was written for a trusted producer — the interpreter itself — and inherits none of the defensive posture you would expect from a format designed to be handed strangers' bytes.