Page MenuHomePhabricator

Pickle Serialization is hiding design flaws, change to JSON
Closed, DeclinedPublic

Description

Bug 60289 suggested to move away from pickle for security reasons. We tried doing that and it uncovered several design flaws with the ReportNode structure. Here are a few:

  • A cohort instance was serialized to the queue for absolutely no reason.
  • The ReportNode tree is created before serialization, then serialized to the queue. When we moved to jsonpickle, this failed due to WTForms fields not deserializing properly. Changing RunReport to create the tree in an overloaded run method is easy, but changing the tests that depend on parse_requests is hard.
  • The ValidateCohort report node needs to be changed if we change where the tree is created, since it needs access to the request context to validate CSRF.

For these reasons, we want to make changing to json serialization a lower priority issue. We can fix Bug 60289 by deploying the puppet module on the production instance of wikimetrics, because that module doesn't run the queue as root. Once that's done, we can turn off C_FORCE_ROOT. At a later date, we should deal with this serialization issue though, and the underlying design flaws.


Version: unspecified
Severity: normal

Details

Reference
bz61961

Related Objects

Event Timeline

bzimport raised the priority of this task from to Normal.Nov 22 2014, 2:58 AM
bzimport set Reference to bz61961.
bzimport added a subscriber: Unknown Object (MLST).

bingle-admin wrote:

Prioritization and scheduling of this bug is tracked on Mingle card https://wikimedia.mingle.thoughtworks.com/projects/analytics/cards/cards/1463

mforns closed this task as Declined.Mar 26 2019, 2:38 PM
mforns added a subscriber: mforns.

Declining because Wikimetrics is being discontinued. See: T211835.

Restricted Application added a project: Analytics. · View Herald TranscriptMar 26 2019, 2:38 PM
Restricted Application added a subscriber: jeblad. · View Herald Transcript