Databases
StackOverflow2013
Postsdbo
POPython pickle - how does it break?
 

Note that there are some explanatory texts on larger screens.

plurals
  1. POPython pickle - how does it break?
    primarykey
    data
    text
    <p>Everyone knows pickle is not a secure way to store user data. It even says so on the box.</p> <p>I'm looking for examples of strings or data structures that break pickle parsing in the current supported versions of <code>cPython &gt;= 2.4</code>. Are there things that can be pickled but not unpickled? Are there problems with particular unicode characters? Really big data structures? Obviously the old ASCII protocol has some issues, but what about the most current binary form?</p> <p>I'm particularly curious about ways in which the pickle <code>loads</code> operation can fail, especially when given a string produced by pickle itself. Are there any circumstances in which pickle will continue parsing past the <code>.</code>?</p> <p>What sort of edge cases are there?</p> <p><strong>Edit:</strong> Here are some examples of the sort of thing I'm looking for: </p> <ul> <li>In Python 2.4, you can pickle an array without error, but you can't unpickle it. <a href="http://bugs.python.org/issue1281383" rel="noreferrer">http://bugs.python.org/issue1281383</a></li> <li>You can't reliably pickle objects that inherit from dict and call <code>__setitem__</code> before instance variables are set with <code>__setstate__</code>. This can be a gotcha when pickling Cookie objects. See <a href="http://bugs.python.org/issue964868" rel="noreferrer">http://bugs.python.org/issue964868</a> and <a href="http://bugs.python.org/issue826897" rel="noreferrer">http://bugs.python.org/issue826897</a></li> <li>Python 2.4 (and 2.5?) will return a pickle value for infinity (or values close to it like 1e100000), but may (depending on platform) fail when loading. See <a href="http://bugs.python.org/issue880990" rel="noreferrer">http://bugs.python.org/issue880990</a> and <a href="http://bugs.python.org/issue445484" rel="noreferrer">http://bugs.python.org/issue445484</a></li> <li>This last item is interesting because it reveals a case where the <code>STOP</code> marker does not actually stop parsing - when the marker exists as part of a literal, or more generally, when not preceded by a newline.</li> </ul>
    singulars
    1. This table or related slice is empty.
    1. This table or related slice is empty.
    1. PTQuestion
    1. USPaul McMillan
    1. USPaul McMillan
    plurals
    1. This table or related slice is empty.
    1. This table or related slice is empty.
    1. This table or related slice is empty.
    1. PO
      singulars
      1. PTAnswer
    2. PO
      singulars
      1. PTAnswer
    1. VO
      singulars
      1. POPython pickle - how does it break?
      1. This table or related slice is empty.
      1. VTUpMod
    2. VO
      singulars
      1. POPython pickle - how does it break?
      1. This table or related slice is empty.
      1. VTUpMod
    3. VO
      singulars
      1. POPython pickle - how does it break?
      1. This table or related slice is empty.
      1. VTUpMod
    1. COYou may want to read the *Security* section of [PEP 307](http://www.python.org/dev/peps/pep-0307/).
      singulars
      1. POPython pickle - how does it break?
      1. USBjörn Pollex
    2. COSpace_C0wb0y: yes, that is why I mentioned it on the first line of my question.
      singulars
      1. POPython pickle - how does it break?
      1. USPaul McMillan
 

Querying!

 
Guidance
A row detail

Detail views are divided into sections. All the information in the data section comes from columns in the selected row. The other sections display data from other, related rows.

Related data can be related in a to-one or a to-many fashion. Captions of data related in a to-many fashion link to a list view showing a filtered view of the table.

Try moving around until you find a non-empty to-many entry and click on the label to get to one. You can move back to the root by clicking on the database name in the header.

SQuiL has stopped working due to an internal error.

If you are curious you may find further information in the browser console, which is accessible through the devtools (F12).

Reload