(DON'T) use Data::Dumper to implement Object persistence

HI, probably you know this trick... (send this node to the Reaper)
I am an Junir OOPerl programmer. Problem is How implement an easy and fast Object persistence trought cgi scripts?
mmmh this my solution is a little bit unsecure :-)

Solution:
use Data::Dumper!

Here an example:

On the fisrt script I generate a big object called $probeset
(something like: $probeset = Probeset -> new)
At the end of the first Script I have stored a lot of informations into this object...
sending all this DATA with a POST could be a crazy thing so...

First script: Dump Object

use Probeset;  # that is my module
use Data::Dumper;

my $store = Data::Dumper -> Dump ([$probeset], [qw(probeset)]);
open (DUMP, "> $file);
print DUMP $store;
close DUMP;
[download]

And now the file DUMP contain an hash of this format:

$probeset = bless( {
                     '_genechip' => 'Human Genome U133A Array',
                     '_probeset_id' => '1007_s_at',
                     '_affy_date' => '2004-12-07',
                     '_chipcode' => 'HG_U133A',
[ ...}
                     '_trans_id' => '????',
                     '_exons_num' => '????',
                     '_organism' => 'Homo sapiens'
                   }, 'Probeset' );
[download]

Second Script take the DUMPED object and Eval IT

use Probeset;
open  (DUMP, "< $tempdump") or die "Can't open dumping file!";
my $obj='';
my $line;
while ($line = <DUMP>) {
    $obj .= $line;
}

my $probeset;
eval $obj;
[download]

And you made the Trick!
Now the second script have in memory the same object that we have generated into the first script with the same Data.
The Only problem that I have notice in this snippet is this:
Object Dumping generate a File, so speed is probably dependent of your hard disk speed!

Regards Davide Rambaldi

Comment on (DON'T) use Data::Dumper to implement Object persistence Select or Download Code

Replies are listed 'Best First'.
Re: use Data::Dumper to implement Object persistence by gellyfish (Monsignor) on Apr 27, 2005 at 16:15 UTC
You really, really want to be careful using this as method of serialization. Firstly because the `eval` can cause any code to be executed on your machine you don't want to find that someone has substituted the content of your file for `system('rm -rf /');` or something equally evil. Secondly because of the way that nearly all Perl serialization schemes work with respect to objects you are subject to the more subtle attack that I discussed at yapc::EU 2001 - whereby default destructors for existing classes can be inadvertantly used against you. The example there shows a serialized hash with duplicate keys whose values are hand crafted `TempFile` objects - the destructor of the `TempFile` deletes a file .... you can guess the rest. /J\	[reply] [d/l] [select]
Re^2: use Data::Dumper to implement Object persistence by tucano (Scribe) on Apr 28, 2005 at 09:32 UTC
thanks for the security warning, I will upgrade my CODE once I have understand how to implemet a easy and secure Serialization. What about using the Class DBM::Deep? better?	[reply]
Re: use Data::Dumper to implement Object persistence by salva (Canon) on Apr 27, 2005 at 16:21 UTC
Data::Dumper is too verbose and slow. It's ok for debugging, but to implement object persistence other modules like Storable are better suited.	[reply]
Re^2: use Data::Dumper to implement Object persistence by friedo (Prior) on Apr 27, 2005 at 21:45 UTC
Here's a plug for my favorite serialization technique: YAML. It's not as fast as storable, but it's human readable (like D::D) and doesn't suffer from the security problems that evaling D::D has. And it's cross-platform; there are parsers and dumpers available for Python, PHP, C and Java. I had a job a couple years ago where we needed to share objects between some in-house mod_perl stuff, some third-party PHP stuff, and some Python stuff from a company we acquired. YAML made this trivial.	[reply]
Re^3: use Data::Dumper to implement Object persistence by IOrdy (Friar) on Apr 28, 2005 at 03:33 UTC
OT but I dont see a C parser for YAML listed on the yaml.org website. If you know of one could you point it out please.	[reply]
Re^4: use Data::Dumper to implement Object persistence by DrHyde (Prior) on Apr 28, 2005 at 10:57 UTC
Re^5: use Data::Dumper to implement Object persistence by gellyfish (Monsignor) on Apr 28, 2005 at 14:48 UTC
Re^2: use Data::Dumper to implement Object persistence by Tanktalus (Canon) on Apr 27, 2005 at 18:18 UTC
Storable and Data::Dumper have their pros and cons. Data::Dumper is slow and verbose. Yes. Storable, however, is much more fragile. If I have two different versions of Storable, it'll be difficult to get them to talk to each other (e.g., persistance crossing upgrade boundaries, or jumping from machine to machine). Yet Data::Dumper works here just fine. Data::Dumper is nice in that it is completely upwards and downwards compatable. That costs - both in CPU speed, and space usage.	[reply]
Re: use Data::Dumper to implement Object persistence by merlyn (Sage) on Apr 27, 2005 at 16:04 UTC
See my lightweight persistent data article. -- Randal L. Schwartz, Perl hacker Be sure to read my standard disclaimer if this is a reply.	[reply]

Solution: use Data::Dumper!

Solution:
use Data::Dumper!