Guido van Rossum wrote: > For untrusted situations, you should design a custom format that > OBVIOUSLY cannot be used to hack into your system. XML sounds pretty > good. Ugh. XML is way to verbose and is slow to parse, IMHO. A limited subset of the pickle or marshal format would be pretty good. > No, for the same reasons as above. I don't think you can prove > [pickle is] safe, so I don't think you should trust it. What about a subset that only included int, float, string, unicode, dict, and tuple? > Making marshal safe would be much easier, as long as you don't use > eval, exec or new.function() on the result. The documentation for marshal says "details of the format are undocumented on purpose; it may change between Python versions". Maybe we need something like marshal that works on a limited set of types and has a stable format. Neil
RetroSearch is an open source project built by @garambo | Open a GitHub Issue
Search and Browse the WWW like it's 1997 | Search results from DuckDuckGo
HTML:
3.2
| Encoding:
UTF-8
| Version:
0.7.4