Path: csiph.com!usenet.pasdenom.info!weretis.net!feeder1.news.weretis.net!feeder.erje.net!eu.feeder.erje.net!newsfeed.freenet.ag!news2.euro.net!newsgate.cistron.nl!newsgate.news.xs4all.nl!post.news.xs4all.nl!not-for-mail
Return-Path: <chris@rebertia.com>
X-Original-To: python-list@python.org
Delivered-To: python-list@mail.python.org
X-Spam-Status: OK 0.013
X-Spam-Evidence: '*H*': 0.97; '*S*': 0.00; 'received:209.85.223': 0.03; 'classes,': 0.05; 'cc:addr:python-list': 0.10; 'dec': 0.15; 'eval': 0.16; 'input.': 0.16; 'non-built-in': 0.16; 'wrote:': 0.17; 'abuse': 0.17; 'email addr:gmail.com&gt;': 0.20; 'cc:2**0': 0.23; '&gt;': 0.23; 'feature': 0.24; 'cc:addr:python.org': 0.25; 'header:In-Reply-To:1': 0.25; 'am,': 0.27; 'message- id:@mail.gmail.com': 0.27; 'pickle': 0.29; 'things,': 0.29; 'performing': 0.30; 'subject: ?': 0.30; 'stuff': 0.30; '11,': 0.33; 'received:google.com': 0.34; 'received:209.85': 0.35; 'but': 0.36; 'data.': 0.36; 'uses': 0.37; 'received:209': 0.37; 'subject:: ': 0.38; 'red': 0.60; 'capable': 0.63; 'safe': 0.63; 'believe': 0.69; 'sender:addr:chris': 0.84
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=rebertia.com; s=google; h=mime-version:sender:in-reply-to:references:date :x-google-sender-auth:message-id:subject:from:to:cc:content-type; bh=x2HBJoeEvH6oqKijcw6HcqbGf23GeW5UotiEFPqXSMo=; b=Xb2E5qzdJ9RbkNQyhCaLa92C9+dm+qjmLI/T06krLSmc9KYXKOxexun1hmJvNupaHi 8M7B0e4/vFcBNaxC8jBe1AcOYD7UwGQeISWFLnijDqGRDJS3/4oK0wW4Xd9M0kqz4YwZ w2izmx1EOjwYVzwUAzyeUkpvnC/kcFQXQ6CaA=
X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=20120113; h=mime-version:sender:in-reply-to:references:date :x-google-sender-auth:message-id:subject:from:to:cc:content-type :x-gm-message-state; bh=x2HBJoeEvH6oqKijcw6HcqbGf23GeW5UotiEFPqXSMo=; b=Zyxez8Ot2skHelROb9+OwYi+j3liiconyF0LrxA0Sastl/vBIib/TDVIafCAOxfDm9 /tmkpO+0rdSW7W/BXctoJamgihtotBE/lOsw+zcHbzF8iJo8Wt9LJIkLlZLydthvZZxA Gh8V4Os+hHsc+vqql5wj04U7oylJ1YSbfaNBAz/bNE2x4Sxh5Y6zOSNPIjN0zu1z2WCe DDtB4vrrASC3f/jqGyt7PebiV99PkKqioJE/y/Tb4JOaJfqw8F6WQjUAJJmGn24D6VML xSPYHtuWmdo3/7LAcKI64PHYo241nR2RCP5kbfzyQJztFSL3ov/8l1iqvaGPA/T9rjmP oVWQ==
MIME-Version: 1.0
Sender: chris@rebertia.com
In-Reply-To: <CADPXuAhQKsnt1t_vMcT_M1FXQKWo12OBOvV=SQW2iud+79TNmA@mail.gmail.com>
References: <CADPXuAhQKsnt1t_vMcT_M1FXQKWo12OBOvV=SQW2iud+79TNmA@mail.gmail.com>
Date: Wed, 12 Dec 2012 09:33:24 -0800
X-Google-Sender-Auth: QStmMsllfpFV0ce5YPZjkIp6TrA
Subject: Re: JSON logging ?
From: Chris Rebert <clp2@rebertia.com>
To: Bart Thate <feedbackflow@gmail.com>
Content-Type: multipart/alternative; boundary=14dae93407fd0c032e04d0ab32c5
X-Gm-Message-State: ALoCoQlJgS4CAIkbqviN11idK7OjBqiQe8iJyxwxXN4vbkhY/Ygssjnw1yawYQmOm7IGoiUpOv2+
Cc: Python <python-list@python.org>
X-BeenThere: python-list@python.org
X-Mailman-Version: 2.1.15
Precedence: list
List-Id: General discussion list for the Python programming language <python-list.python.org>
List-Unsubscribe: <http://mail.python.org/mailman/options/python-list>, <mailto:python-list-request@python.org?subject=unsubscribe>
List-Archive: <http://mail.python.org/pipermail/python-list/>
List-Post: <mailto:python-list@python.org>
List-Help: <mailto:python-list-request@python.org?subject=help>
List-Subscribe: <http://mail.python.org/mailman/listinfo/python-list>, <mailto:python-list-request@python.org?subject=subscribe>
Newsgroups: comp.lang.python
Message-ID: <mailman.783.1355333612.29569.python-list@python.org>
Lines: 31
NNTP-Posting-Host: 2001:888:2000:d::a6
X-Trace: 1355333612 news.xs4all.nl 6958 [2001:888:2000:d::a6]:35350
X-Complaints-To: abuse@xs4all.nl
Xref: csiph.com comp.lang.python:34705

--14dae93407fd0c032e04d0ab32c5
Content-Type: text/plain; charset=UTF-8

On Dec 11, 2012 7:33 AM, "Bart Thate" <feedbackflow@gmail.com> wrote:
<snip>
> pickle uses eval still ? or is is considered safe now ? i was told not to
use eval() stuff on data.

I don't believe pickle uses eval() per se, but per the red warning box in
its docs, it's still not safe when given untrusted input. IIRC, among other
things, in order to unpickle non-built-in classes, it is capable of
performing imports; this feature is rife for abuse by an adversary.

--14dae93407fd0c032e04d0ab32c5
Content-Type: text/html; charset=UTF-8
Content-Transfer-Encoding: quoted-printable

<p dir=3D"ltr">On Dec 11, 2012 7:33 AM, &quot;Bart Thate&quot; &lt;<a href=
=3D"mailto:feedbackflow@gmail.com">feedbackflow@gmail.com</a>&gt; wrote:<br=
>
&lt;snip&gt;<br>
&gt; pickle uses eval still ? or is is considered safe now ? i was told not=
 to use eval() stuff on data.</p>
<p dir=3D"ltr">I don&#39;t believe pickle uses eval() per se, but per the r=
ed warning box in its docs, it&#39;s still not safe when given untrusted in=
put. IIRC, among other things, in order to unpickle non-built-in classes, i=
t is capable of performing imports; this feature is rife for abuse by an ad=
versary.</p>


--14dae93407fd0c032e04d0ab32c5--