Logged In: YES 
user_id=12800

I'm going to agree with Paul that this is a problem needing
fixing, however there are really several issues.

1. Cookie module makes it too easy to code exploits.  Cookie
exports a class, also called Cookie, which is aliased to
SmartCookie, so that a naive program will simply pass cookie
data to Cookie.Cookie() and you're screwed.  So, Cookie
module's defaults should be for more security rather than
less, and Cookie.Cookie should be aliased to SimpleCookie
instead.

2. There is no built-in safe mechanism for de-serializing
data from untrusted sources.  You can't use pickle without
overloading a "magic" method.  You can't use cPickle because
you can't do the overloading trick.  You can't use marshal
because it isn't bulletproof against recursive
datastructures.  So how /do/ you do it?

I think it just may be serious enough to deal with in Python
2.2, and I volunteer to address it (so I'll steal this bug
report).  Without looking at the code, or the level of
effort necessary, I would make the following suggestions:

1. Add to the public interface of pickle and cPickle, a flag
that either disables the unpickling of instances altogether,
or disables calling any code with unpickled data, e.g.
constructors.

2. Fix marshal to be bulletproof against recursive
datastructures.
3. Update the docs for both pickle/cPickle and marshal to
explain how to safely write de-serializers of untrusted strings.