2

I'd like my wxPython application to support cut/copy/paste operations between different running instances of the application. Is it OK to simply pickle a data structure, copy it to clipboard as text, and then unpickle it for paste operations?

I know I'd have to check the data for some sign that it's from my app. Or could I just TRY to unpickle whatever is there? How robust is pickle at nicely failing if it tries to unpickle arbitrary text left on the clipboard?

Also, is there a practical limit to how much data could be copied this way?

I'm running on Windows and Linux today - have not tried Mac.

EDIT I'm aware of that comment in the documentation. I don't really care about a malicious user trying to compromise his own instance of the software, if that's what people are worried about they should deprecate pickle. My questions are of practicality, not security.

2
  • And what if another program wants to use the clipboard at the same time?
    – dan04
    Jul 29, 2011 at 19:50
  • @dan: like any other software using cut/copy/paste functionalities
    – neurino
    Jul 29, 2011 at 19:52

2 Answers 2

1

You should not trust data from the clipboard for unpickling, unless you have a sure way to make sure it was wrtten by your app, and has not been altered.

From the python documentation:

Warning The pickle module is not intended to be secure against erroneous or maliciously constructed data. Never unpickle data received from an untrusted or unauthenticated source.

1

If applicable I suggest you to convert your data to and from json using one of the many python implementations.

Being plain text is easy to transfer using clipboard moreover there are no risks converting back a json object back to python.

One last thing: no risks of deprecation.

1
  • My data structures are not a strict hierarchy. Some objects point to their parent for example. I'm working to minimize that, but it's still there. From googling JSON it doesn't look quite up to the task. Also, same questions apply.
    – phkahler
    Jul 31, 2011 at 19:53

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.