loading data

[konstantinstadler]

The metadata file holds all info necessary for loading. There should be a method to just use

data, meta = fi.load_data(metadatafile)

or similar

[EsmeMaxwell]

Aye, can do that up to a limitation but it becomes tricky* if the user extends the custom info classes. Absolutely fine if the user is only using what's in the package though.

• • We need to know which classes to instantiate and because we're allowing the user to extend the classes, these may not be known until runtime. The class names are stored in the metafile but instantiationg from this completely dynamically would open up the possibility that a malicious file could instantiate arbitrary classes. So at the moment, I pass it through a supplied context to ensure only known classes can be instantiated. This problem is not so unusual in these sort of setups afaik (I would guess that this is the reason for the warnings around Python's pickle functions).

[konstantinstadler]

Just think of the very simplest string based dict

---

From: Esmé Maxwell @.> Sent: Friday, April 26, 2024 1:08:30 PM To: EXIOBASE/df_file_interchange @.> Cc: Konstantin Stadler @.>; Author @.> Subject: Re: [EXIOBASE/df_file_interchange] loading data (Issue #17)

Aye, can do that up to a limitation but it becomes tricky* if the user extends the custom info classes. Absolutely fine if the user is only using what's in the package though.

*

• We need to know which classes to instantiate and because we're allowing the user to extend the classes, these may not be known until runtime. The class names are stored in the metafile but instantiationg from this completely dynamically would open up the possibility that a malicious file could instantiate arbitrary classes. So at the moment, I pass it through a supplied context to ensure only known classes can be instantiated. This problem is not so unusual in these sort of setups afaik (I would guess that this is the reason for the warnings around Python's pickle functions).

— Reply to this email directly, view it on GitHubhttps://github.com/EXIOBASE/df_file_interchange/issues/17#issuecomment-2079175921, or unsubscribehttps://github.com/notifications/unsubscribe-auth/ABTX7S2DXNVB4FCESGZYFMTY7IYS5AVCNFSM6AAAAABG2Q5U3WVHI2DSMVQWIX3LMV43OSLTON2WKQ3PNVWWK3TUHMZDANZZGE3TKOJSGE. You are receiving this because you authored the thread.Message ID: @.***>

[EsmeMaxwell]

Done.