Re: "Rehabilitating Pickle" a talk at PyCon UK 2018

--000000000000b88624058025d5e9
Content-Type: text/plain; charset="UTF-8"
Content-Transfer-Encoding: quoted-printable

What would be necessary to limit pickling in ZODB to read only
specific/whitelisted classes?

I chose ZODB as the file storage format for my speaker crossover program
and wrote a very thin wrapper around ZODB which puts a FileStorage .fs into
the tmp dir, opens it and copies it back when saving. Works great but now
that I hear that pickles are inherently unsafe I wonder how I can mitigate
this.

Best regards,
J=C3=BCrgen

Am Mi., 16. Jan. 2019 um 11:33 Uhr schrieb Christopher Lozinski <
[email protected]>:

> I found this talk quite interesting.
>
> 9 minutes ago <https://twitter.com/PythonLinks/status/1085482554000580608=
>
>
> Pickle is a compact serialization protocol for Python objects. Great for
> communication between #distributed
> <https://twitter.com/hashtag/distributed?src=3Dhash> #Python
> <https://twitter.com/hashtag/Python?src=3Dhash> programs, but it is not
> safe. What can be done?
>
> https://pythonlinks.info/rehabilitating-pickle
>
>
> Warm Regards
> Chris
>
> --
> You received this message because you are subscribed to the Google Groups
> "zodb" group.
> To unsubscribe from this group and stop receiving emails from it, send an
> email to [email protected].
> For more options, visit https://groups.google.com/d/optout.
>

--=20
You received this message because you are subscribed to the Google Groups "=
zodb" group.
To unsubscribe from this group and stop receiving emails from it, send an e=
mail to [email protected].
For more options, visit https://groups.google.com/d/optout.

--000000000000b88624058025d5e9
Content-Type: text/html; charset="UTF-8"
Content-Transfer-Encoding: quoted-printable

<div dir=3D"ltr">What would be necessary to limit pickling in ZODB to read =
only specific/whitelisted classes?<div><br></div><div>I chose ZODB as the f=
ile storage format for my speaker crossover program and wrote a very thin w=
rapper around ZODB which puts a FileStorage .fs into the tmp dir, opens it =
and copies it back when saving. Works great but now that I hear that pickle=
s are inherently unsafe I wonder how I can mitigate this.<br></div><div><br=
></div><div>Best regards,</div><div>J=C3=BCrgen</div></div><br><div class=
=3D"gmail_quote"><div dir=3D"ltr" class=3D"gmail_attr">Am Mi., 16. Jan. 201=
9 um 11:33=C2=A0Uhr schrieb Christopher Lozinski &lt;<a href=3D"mailto:lozi=
[email protected]">[email protected]</a>&gt;:<br>=
</div><blockquote class=3D"gmail_quote" style=3D"margin:0px 0px 0px 0.8ex;b=
order-left:1px solid rgb(204,204,204);padding-left:1ex"><div style=3D"overf=
low-wrap: break-word;"><div>I found this talk quite interesting. =C2=A0</di=
v><div><br></div><div><div class=3D"gmail-m_-1581236281649401542stream-item=
-header" style=3D"display:flex;color:rgb(20,23,26);font-family:&quot;Helvet=
ica Neue&quot;,Helvetica,Arial,sans-serif;font-size:14px;font-variant-ligat=
ures:normal;background-color:rgb(255,255,255)"><small class=3D"gmail-m_-158=
1236281649401542time" style=3D"font-size:14px;color:rgb(101,119,134);margin=
-right:5px;white-space:nowrap"><span class=3D"gmail-m_-1581236281649401542u=
-hiddenVisually" style=3D"background-color:transparent;color:rgb(101,119,13=
4);text-decoration:none;border:0px;font-size:1px;height:1px;overflow:hidden=
;padding:0px;width:1px"><a href=3D"https://twitter.com/PythonLinks/status/1=
085482554000580608" class=3D"gmail-m_-1581236281649401542js-nav gmail-m_-15=
81236281649401542tweet-timestamp gmail-m_-1581236281649401542js-permalink g=
mail-m_-1581236281649401542js-tooltip" title=3D"2:23 AM - 16 Jan 2019" styl=
e=3D"background-color:transparent;color:rgb(101,119,134);text-decoration:no=
ne" target=3D"_blank">9 minutes ago</a></span></small></div><div class=3D"g=
mail-m_-1581236281649401542js-tweet-text-container" style=3D"color:rgb(20,2=
3,26);font-family:&quot;Helvetica Neue&quot;,Helvetica,Arial,sans-serif;fon=
t-size:14px;font-variant-ligatures:normal;background-color:rgb(255,255,255)=
"><p class=3D"gmail-m_-1581236281649401542TweetTextSize gmail-m_-1581236281=
649401542tweet-text gmail-m_-1581236281649401542js-tweet-text" lang=3D"en" =
style=3D"margin:0px 0px 8px;line-height:20px;white-space:pre-wrap">Pickle i=
s a compact serialization protocol for Python objects. Great for communicat=
ion between <a href=3D"https://twitter.com/hashtag/distributed?src=3Dhash" =
class=3D"gmail-m_-1581236281649401542twitter-hashtag gmail-m_-1581236281649=
401542js-nav gmail-m_-1581236281649401542pretty-link" dir=3D"ltr" style=3D"=
background:transparent;color:rgb(27,149,224);text-decoration:none" target=
=3D"_blank">#distributed</a> <a href=3D"https://twitter.com/hashtag/Python?=
src=3Dhash" class=3D"gmail-m_-1581236281649401542twitter-hashtag gmail-m_-1=
581236281649401542js-nav gmail-m_-1581236281649401542pretty-link" dir=3D"lt=
r" style=3D"background:transparent;color:rgb(27,149,224);text-decoration:no=
ne" target=3D"_blank">#Python</a> programs, but it is not safe.=20
What can be done?</p></div></div><div><br></div><div><a href=3D"https://pyt=
honlinks.info/rehabilitating-pickle" target=3D"_blank">https://pythonlinks.=
info/rehabilitating-pickle</a></div><div><br></div><div><br></div><div>Warm=
 Regards</div><div>Chris</div></div>

<p></p>

-- <br>
You received this message because you are subscribed to the Google Groups &=
quot;zodb&quot; group.<br>
To unsubscribe from this group and stop receiving emails from it, send an e=
mail to <a href=3D"mailto:[email protected]" target=3D"_bla=
nk">[email protected]</a>.<br>
For more options, visit <a href=3D"https://groups.google.com/d/optout" targ=
et=3D"_blank">https://groups.google.com/d/optout</a>.<br>
</blockquote></div>

<p></p>

-- <br />
You received this message because you are subscribed to the Google Groups &=
quot;zodb&quot; group.<br />
To unsubscribe from this group and stop receiving emails from it, send an e=
mail to <a href=3D"mailto:[email protected]">zodb+unsubscri=
[email protected]</a>.<br />
For more options, visit <a href=3D"https://groups.google.com/d/optout">http=
s://groups.google.com/d/optout</a>.<br />

--000000000000b88624058025d5e9--