Remove ability to `__setstate__` from "legacy" tuple format soon
Nobody has claimed this yet.
Assessment
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Newbie friendliness
- 35/100
Research direction
Read issues #1004, #1009, and #1085 first to understand the tuple deserialization compatibility history, then locate the relevant handling in attrs. The work is done when legacy tuple support is removed without reintroducing the breakage described in #1085, with the affected compatibility behavior covered appropriately.
Written by the indexing model from the issue text.
Description
This original issue #1004 describes the problem with returning a tuple from __setstate__, so #1009 removed it. But once new release was actually cut #1085 reported that this actually broke a lot of stuff, and support for unpickling from tuple was added back in.
The problem with this is that anyone who stores pickled representations of their objects with code using versions prior to 22.2 is till vulnerable to the issue described in #1004 ( potentially assigning a wrong value to a an attribute on unpickle).
Let's try to really remove the support for tuple on deserialisation in a newer version (best is 22.3) once more people have had a chance to re-process their data using newer code.
I don't think we can ever guarantee that no one in the world will be hit by the issue like #1085 again, but at leas at this point there will be an officially released version (the first one containing #1085) that can be used to re-process the data once the support is gone from trunk.
Storing data in long term storage remains a bad idea that maybe Python official docs could do more to warn people about alongside the security concerns (which are very prominent in the docs).
- Dominant language
- Python
- Stars
- 5.8k
- Forks
- 480
- Avg merge
- 2h 15m
- Merged PRs (30d)
- 2
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
More from python-attrs/attrs
-
Difficulty 5/5 Over a week Newbie friendliness 20/100
python-attrs/attrs#1620 ·
-
Difficulty 3/5 1-2 days Newbie friendliness 55/100
python-attrs/attrs#1596 · 2 comments · 1 reaction ·
-
Difficulty 4/5 3-5 days Newbie friendliness 35/100
python-attrs/attrs#1549 · 3 comments ·
-
Difficulty 4/5 3-5 days Newbie friendliness 38/100
python-attrs/attrs#1543 · 2 comments ·
-
Difficulty 4/5 3-5 days Newbie friendliness 35/100
python-attrs/attrs#1532 ·
All issues in python-attrs/attrs
Similar issues
-
Difficulty 2/5 1-3 hours Newbie friendliness 88/100
-
Difficulty 2/5 1-3 hours Newbie friendliness 82/100
-
Difficulty 2/5 1-3 hours Newbie friendliness 78/100
-
enhancement
Difficulty 2/5 1-3 hours Newbie friendliness 72/100
-
Difficulty 2/5 1-3 hours Newbie friendliness 74/100