Could we use an unrepr module?

[Benoit Boissinot]

On Thu, May 5, 2011 at 6:59 PM, Martin Geisler <mg at lazybytes.net> wrote:
> Brodie Rao <brodie at bitheap.org> writes:
>
>> On Thu, May 5, 2011 at 8:17 AM, Martin Geisler <mg at aragost.com> wrote:
>>> Hi guys,
>>>
>>> I needed a way to serialize data for the lock extension, so I wrote a
>>> small module that reverses the normal repr function in Python. It is
>>> like eval, but does not execute anything.
>>>
>>> I think we could use such a module here and there in Mercurial. As an
>>> example, I happened to look at the code that writes the merge state:
>>
>> Maybe I'm missing something here, but why not just use pickle?
>
> Both pickle and the simpler marshal are unsafe since they can end up
> executing data. I'm not really sure why they would do that, but the
> documentation warns about it for both modules.

And why not something like JSON?

cheers,

Benoit