non-pickle persistance for dicts?

Charles Hixson charleshixsn at earthlink.net
Wed May 16 17:52:33 EDT 2012


I want to persist simple dicts, but due to the security problems with 
(un)pickle, I'd prefer to not use shelve, and the only way I could see 
to persist them onto sqlite also invoked pickle.

As (un)pickle allows arbitrary system commands to be issued, I'd really 
rather just use a simple convert to and from either bytes or strings.  
repr works well for the conversion into string (I said they were 
simple), but I'd really rather be able to turn "{'a': 'A', 1: 23, 2: 
['b', 2]}" back into a dict without allowing the execution of arbitrary 
commands.

Any suggestions?

-- 
Charles Hixson




More information about the Python-list mailing list