Use JSONVariable instead of Pickle (GL01-00??)

[hellais]

For security reasons we should probably be storing the variables in the database in JSON form rather than pickle.

Even though we are safely encoding and decoding the content of the pickle with json.loads and json.dumps we could have the ORM handle this transparently and make it less prone to errors.

http://bazaar.launchpad.net/~storm/storm/trunk/view/head:/storm/locals.py#L23

http://bazaar.launchpad.net/~storm/storm/trunk/view/head:/storm/variables.py#L626

This change requires writing also a database migration script that will port the old version of the database to the newer one.

In globaleaks code the change would happen here:
https://github.com/globaleaks/GLBackend/blob/master/globaleaks/models.py#L9

This was suggested by abraham from cure53.

[evilaliv3]

This seems fine to me also.

[vecna]

this is the start, I would upgrade to JSON with the database version 2 https://github.com/globaleaks/GLBackend/commit/06ddf75bbba002861757d58d8166a0741a060980

[fpietrosanti]

@vecna is now this done as part of multi-language translation?

[fpietrosanti]

applied security tag

[vecna]

DB version since 3 to 4

[vecna]

@hellais

Even though we are safely encoding and decoding the content of the pickle with json.loads and json.dumps we
could have the ORM handle this transparently and make it less prone to errors.

but, in the base handler are performed checks inside the decoded JSON, and also some modification of requests are happening at the moment (it's an unclean behavior, because request need to be unchanged by users http-action), the we've just to re-encode in JSON the request dict, and then copy in the ORM ?

[vecna]

@mmaker @hellais @evilaliv3 JSON instead of Pickle. remind of this security task left open since the first PT.

[evilaliv3]

bye, bye, bye my pickles!
I'll be seeing you again
Yeah, I'll be seeing you, in hell