Skip to content

Commit 1fe585d

Browse files
committed
Update documentation for CloudpickleMaterializer warning
- Clarified the warning regarding the use of the built-in CloudpickleMaterializer, emphasising the potential security risks associated with uploading arbitrary objects. - Improved the link to the custom Materializer documentation for better guidance on creating robust and efficient formats. This update aims to enhance user awareness of security implications and provide clearer instructions for safer practices in ZenML step output handling.
1 parent 2fc5624 commit 1fe585d

File tree

1 file changed

+1
-1
lines changed

1 file changed

+1
-1
lines changed

docs/book/how-to/pipeline-development/build-pipelines/step-output-typing-and-annotation.md

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -14,7 +14,7 @@ Your functions will work as ZenML steps even if you don't provide any type annot
1414
* **Better serialization**: Without type annotations, ZenML uses [Cloudpickle](https://github.com/cloudpipe/cloudpickle) to serialize your step outputs. When provided with type annotations, ZenML can choose a [materializer](https://docs.zenml.io/getting-started/core-concepts#materializers) that is best suited for the output. In case none of the builtin materializers work, you can even [write a custom materializer](https://docs.zenml.io/how-to/data-artifact-management/handle-data-artifacts/handle-custom-data-types).
1515

1616
{% hint style="warning" %}
17-
ZenML provides a built-in [CloudpickleMaterializer](https://sdkdocs.zenml.io/latest/core\_code\_docs/core-materializers/#zenml.materializers.cloudpickle\_materializer.CloudpickleMaterializer) that can handle any object by saving it with [cloudpickle](https://github.com/cloudpipe/cloudpickle). However, this is not production-ready because the resulting artifacts cannot be loaded when running with a different Python version. In such cases, you should consider building a [custom Materializer](../handle-data-artifacts/handle-custom-data-types.md#custom-materializers) to save your objects in a more robust and efficient format.
17+
ZenML provides a built-in [CloudpickleMaterializer](https://sdkdocs.zenml.io/latest/core\_code\_docs/core-materializers/#zenml.materializers.cloudpickle\_materializer.CloudpickleMaterializer) that can handle any object by saving it with [cloudpickle](https://github.com/cloudpipe/cloudpickle). However, this is not production-ready because the resulting artifacts cannot be loaded when running with a different Python version. In such cases, you should consider building a [custom Materializer](https://docs.zenml.io/how-to/data-artifact-management/handle-data-artifacts/handle-custom-data-types#custom-materializers) to save your objects in a more robust and efficient format.
1818

1919
Moreover, using the `CloudpickleMaterializer` could allow users to upload of any kind of object. This could be exploited to upload a malicious file, which could execute arbitrary code on the vulnerable system.
2020
{% endhint %}

0 commit comments

Comments
 (0)