Is deserialize secure?

[debiankaios]

If anyone edit the serialized files that a virus will downloaded and started(yes it's possible in lua) will that in deseralize process blocked. I found that bytecode will blocked and if i try to let anything to print from the file it don't work to. Is serializing secure?

[rubenwardy]

No, passing untrusted strings to minetest.deserialize can allow malicious users to freeze the server, and before 5.2 allows them to run any Lua code in the server environment

You should only pass strings that have been created by minetest.serialize. It's fine to pass user input to that function, and then to deserialize

[debiankaios]

You should only pass strings that have been created by minetest.serialize. It's fine to pass user input to that function, and then to deserialize

But how can i sure that it get serialized first?