3 ms·
Can you safely "pickle" Python objects across different architectures and Python version (assuming we forget about Python 2)?
by mrweasel 4y ago
Can you safely "pickle" Python objects across different architectures and Python version (assuming we forget about Python 2)?
- NegativeLatency 4y agoThere's a version on the pickle format, so you might be able to do it across versions but I suspect the version has changed for security reasons over time?
- Spivak 4y agoPickle could in theory could be architecture dependent since __getstate__, and __setstate__ are user provided options. But you would have to try to do that on purpose. And you don't even have to forget about Python 2! If you use format version 2 you can pickle objects from every version from Python 2.3+ and all pickle format are promised to be backwards compatible. If you only care about Python 3 then you can use version 3 and it will work for all Python 3.0+. https://docs.python.org/3/library/pickle.html#data-stream-format https://docs.python.org/3/library/pickle.html#data-stream-fo... The reason against using pickle hasn't changed though, if you wouldn't exec() it, don't unpickle it. If you're going to send it over the network use MAC use MAC use MAC. Seriously, it's built in -- the hmac module.
- mmcgaha 4y agoWe had a program that was sending a pickled session state as a cookie. We solved that by packing the cookie as a random string, a timestamp, the object, and a MAC. We validated the MAC, then checked the timestamp, and finally unpickle the object. It still bothers me that we are unpickling data passed by the client but I ran arguments against doing it.
- xcombelle 4y agoone big problem with pickle is that deserialization might fail if the object serialized evolve