Question: JSON serialization may be incompatible with recording calls to the Django's cache(s) when using MemoryStore

[GNajeraAdv]

Hi!

I'm trying to write up a concise example for version 6.0.0 of "django-debug-toolbar", but I think the JSON serialization introduced in release version 6.0.0 may be incompatible with recording calls to the Django's cache(s).

The only guideline for using the cache is "key should be a str, and value can be any picklable Python object.", and I'm actively seeing this erroring out in my project.

For example, when the "django-debug-toolbar" saves the "cache" panel details, it attempts to serialize the data into a JSON string.

However, it is perfectly valid for the data to contain complex Python objects (such as a Python dictionary that uses a Python Class as one of its keys).

I assume using "pickle" instead of JSON would resolve this, but maybe I'm oversimplifying this

[tim-schilling]

This is a duplicate of #2171

Pickle isn't really a reasonable choice as it isn't secure when you can't trust the user input. Since this would pickle pretty much everything associated with the request, there's likely a path for it to be a security vulnerability. Though it'd be something obscure.

[GNajeraAdv]

Thanks @tim-schilling!

Totally understand about the security concerns. I was hoping there was a common design pattern to securely store and retrieve pickled objects, but let's table that for now.

This is different from #2171 (that fix doesn't resolve my error). In my case, I'm using MemoryStore and when it saves the panels, I get a HTTP 500 response (not just an extra log emitted from Python into stderr)

---

I can't get the tests running on the "django-debug-toolbar", but I believe if you run the code snippet in one of the tests, you'll see the error I'm seeing. Note that I'm testing with a dict with a Python class as the key.

MemoryStore.save_panel(1, 1, {str: "this-is-a-string"})

---

I'll continue to attempt to get a test to showcase this issue, but I'm hoping this example is clear.

[tim-schilling]

@GNajeraAdv Can you share your stacktrace and error? I understand you're trying to help me reproduce it, but I won't know if I'm reproducing the same thing without seeing what you're seeing.