luciano/nippy
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Merge pull request #25 from weavejester/edn-reader

Browse source 
Switch reader to safe EDN reader
This commit is contained in:
Peter Taoussanis 2013-08-06 23:52:49 -07:00
commit 35c8954e8f
2 changed files with 15 additions and 19 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

7
project.clj
View file

@ -3,9 +3,10 @@
:url "https://github.com/ptaoussanis/nippy" :url "https://github.com/ptaoussanis/nippy"
:license {:name "Eclipse Public License" :license {:name "Eclipse Public License"
:url "http://www.eclipse.org/legal/epl-v10.html"} :url "http://www.eclipse.org/legal/epl-v10.html"}
:dependencies [[org.clojure/clojure "1.4.0"] :dependencies [[org.clojure/clojure "1.4.0"]
[expectations "1.4.49"] [org.clojure/tools.reader "0.7.5"]
[org.iq80.snappy/snappy "0.3"]] [expectations "1.4.49"]
[org.iq80.snappy/snappy "0.3"]]
:profiles {:1.4 {:dependencies [[org.clojure/clojure "1.4.0"]]} :profiles {:1.4 {:dependencies [[org.clojure/clojure "1.4.0"]]}
:1.5 {:dependencies [[org.clojure/clojure "1.5.1"]]} :1.5 {:dependencies [[org.clojure/clojure "1.5.1"]]}
:1.6 {:dependencies [[org.clojure/clojure "1.6.0-master-SNAPSHOT"]]} :1.6 {:dependencies [[org.clojure/clojure "1.6.0-master-SNAPSHOT"]]}

27
src/taoensso/nippy.clj
View file

@ -5,7 +5,9 @@
(:require [taoensso.nippy (:require [taoensso.nippy
(utils :as utils) (utils :as utils)
(compression :as compression :refer (snappy-compressor)) (compression :as compression :refer (snappy-compressor))
(encryption :as encryption :refer (aes128-encryptor))]) (encryption :as encryption :refer (aes128-encryptor))]
[clojure.tools.reader
(edn :as edn)])
(:import [java.io DataInputStream DataOutputStream ByteArrayOutputStream (:import [java.io DataInputStream DataOutputStream ByteArrayOutputStream
ByteArrayInputStream] ByteArrayInputStream]
[clojure.lang Keyword BigInt Ratio PersistentQueue PersistentTreeMap [clojure.lang Keyword BigInt Ratio PersistentQueue PersistentTreeMap
@ -227,7 +229,7 @@
(let [type-id (.readByte s)] (let [type-id (.readByte s)]
(utils/case-eval type-id (utils/case-eval type-id
id-reader (read-string (read-utf8 s)) id-reader (edn/read-string (read-utf8 s))
id-bytes (read-bytes s) id-bytes (read-bytes s)
id-nil nil id-nil nil
id-boolean (.readBoolean s) id-boolean (.readBoolean s)
@ -262,7 +264,7 @@
(bigint (read-biginteger s))) (bigint (read-biginteger s)))
;;; DEPRECATED ;;; DEPRECATED
id-old-reader (read-string (.readUTF s)) id-old-reader (edn/read-string (.readUTF s))
id-old-string (.readUTF s) id-old-string (.readUTF s)
id-old-map (apply hash-map (utils/repeatedly-into [] id-old-map (apply hash-map (utils/repeatedly-into []
(* 2 (.readInt s)) (thaw-from-stream s))) (* 2 (.readInt s)) (thaw-from-stream s)))
@ -283,11 +285,8 @@
(defn thaw-from-stream! (defn thaw-from-stream!
"Low-level API. Deserializes a frozen object from given DataInputStream to its "Low-level API. Deserializes a frozen object from given DataInputStream to its
original Clojure data type." original Clojure data type."
[data-input-stream & [{:keys [read-eval?]}]] [data-input-stream]
(if (identical? *read-eval* read-eval?) (thaw-from-stream data-input-stream))
(thaw-from-stream data-input-stream)
(binding [*read-eval* read-eval?] ; Expensive
(thaw-from-stream data-input-stream))))
(defn- try-parse-header [ba] (defn- try-parse-header [ba]
(when-let [[head-ba data-ba] (utils/ba-split ba 4)] (when-let [[head-ba data-ba] (utils/ba-split ba 4)]
@ -298,11 +297,8 @@
(defn thaw (defn thaw
"Deserializes a frozen object from given byte array to its original Clojure "Deserializes a frozen object from given byte array to its original Clojure
data type. Supports data frozen with current and all previous versions of data type. Supports data frozen with current and all previous versions of
Nippy. For custom types extend the Clojure reader or see `extend-thaw`. Nippy. For custom types extend the Clojure reader or see `extend-thaw`."
[^bytes ba & [{:keys [password compressor encryptor legacy-opts readers]
WARNING: Enabling `:read-eval?` can lead to security vulnerabilities unless
you are sure you know what you're doing."
[^bytes ba & [{:keys [read-eval? password compressor encryptor legacy-opts readers]
:or {legacy-opts {:compressed? true} :or {legacy-opts {:compressed? true}
compressor snappy-compressor compressor snappy-compressor
encryptor aes128-encryptor} encryptor aes128-encryptor}
@ -321,7 +317,7 @@
ba (if compressor (compression/decompress compressor ba) ba) ba (if compressor (compression/decompress compressor ba) ba)
stream (DataInputStream. (ByteArrayInputStream. ba))] stream (DataInputStream. (ByteArrayInputStream. ba))]
(thaw-from-stream! stream {:read-eval? read-eval?})) (thaw-from-stream! stream))
(catch Exception e (catch Exception e
(cond (cond
@ -459,8 +455,7 @@
:password nil})) :password nil}))
(defn thaw-from-bytes "DEPRECATED: Use `thaw` instead." (defn thaw-from-bytes "DEPRECATED: Use `thaw` instead."
[ba & {:keys [read-eval? compressed?] [ba & {:keys [compressed?]
:or {compressed? true}}] :or {compressed? true}}]
(thaw ba {:legacy-opts {:compressed? compressed?} (thaw ba {:legacy-opts {:compressed? compressed?}
:read-eval? read-eval?
:password nil})) :password nil}))