secure unpickle?

[Yun Mao]

Hi, I'm looking for a way in unpickling, or equivalent, such that can only
unpickle (or is limited to) simple data structure, such as number, string,
list, tuples.

The doc I found http://www.python.org/doc/2.2.3/lib/pickle-sec.html was
helpful but still not very clear to me.

Thanks!

-Y

 

[Gandalf]

Hi, I'm looking for a way in unpickling, or equivalent, such that can only
unpickle (or is limited to) simple data structure, such as number, string,
list, tuples.

The doc I found http://www.python.org/doc/2.2.3/lib/pickle-sec.html was
helpful but still not very clear to me.

Thanks!

-Y

I'm using this module (based on the documentation you mentioned):

import cStringIO
import cPickle

def dumps(obj):
"""Dumps an object into a string.

@param obj: The object to dump. It should not be a user defined
object nor a global.
It should only contain built-in types. (Will not raise an
exception anyway.)
@return: The dumped object as a string.
"""
f = cStringIO.StringIO()
p = cPickle.Pickler(f,1)
p.dump(obj)
return f.getvalue()

def loads(s):
"""Loads an object from a string.

@param s: The string to load the object from.
@return: The object loaded from the string. This function will not
unpickle globals and instances.
"""
f = cStringIO.StringIO(s)
p = cPickle.Unpickler(f)
p.find_global = None
return p.load()

 

[John J. Lee]

Hi, I'm looking for a way in unpickling, or equivalent, such that can only
unpickle (or is limited to) simple data structure, such as number, string,
list, tuples.

marshal

The docs have similar warnings, though.

What's are you trying to do?


I'm amazed that WAYTTD isn't a standard USENET acronym by now...


John

 

[John J. Lee]

I'm using this module (based on the documentation you mentioned):

[...snip...]

What does this have to do with the question? He was worried about
security of pickle, not asking how to call dumps() and loads().


John

 

[Gandalf]

[...]

I'm using this module (based on the documentation you mentioned):

[...snip...]

What does this have to do with the question? He was worried about
security of pickle, not asking how to call dumps() and loads().

Well, in that case, get my humble apologies.

 

[Paul Rubin]

marshal

The docs have similar warnings, though.

Marshal has an additional problem, which is that the format can change
incompatibly between one Python version and another. So if you use
marshal for object persistence and upgrade your Python instance, you
can be screwed.

There is no clearly good solution to this issue. There are a couple
of bug entries in Sourceforge about it.

 

[John J. Lee]

I'm using this module (based on the documentation you mentioned):

[...snip...]

What does this have to do with the question? He was worried about
security of pickle, not asking how to call dumps() and loads().

Well, in that case, get my humble apologies.

It was an honest question (even though I didn't expect a useful answer
;-). I now see (thanks to Tim's post) you *did* have an answer in
there.


John

 

[Michael Hudson]

Marshal has an additional problem, which is that the format can change
incompatibly between one Python version and another.

Oh, and this:
Segmentation fault

There's a patch from Armin that I'm supposed to be reviewing about
that...

I really wouldn't unmarshal input that could come from some random
source on the internet.

Cheers,
mwh