Beefy Boxes and Bandwidth Generously Provided by pair Networks
Think about Loose Coupling

(Yet Another) Safely eval Data::Dumper objects module

by Felonious (Chaplain)
on Mar 14, 2002 at 05:33 UTC ( #151604=snippet: print w/replies, xml ) Need Help??
Description: Hello,

I sometimes use Data::Dumper to pass "objects" over the network. Yeah, I know about
Storable, but I rather like Data::Dumper for the text readability. I ran across this
article by Randal Schwartz (merlyn), and that got me to thinking harder about the security.
I already use to cage the eval, but I couldn't help but develope a sense of
paranoia over that being enough. Undumper (from the link above) seemed a strange way
of going about it to me, so I decided to investigate Safe's ability to limit opcodes.
The result is the code below.
Criticisms not only welcomed, but appreciated.

Warning: This code has not been thoroughly reviewed by a security expert. Therefore,
it would be foolish for you to use it in any way without knowing what you
are doing.

Update: Added 'rv2gv', 'null' and 'undef' to defaults.

Update 2: This code is crap. Don't use it at all.
package Data::Revive;

# This is (hopefully) the bare minimum of opcodes
# necessary to use normal objects.
# Pass in "-opcode" to disable any default opcode,
# or any opcode not listed here to enable it.
my @defaults = qw {

sub revive_object {

    my $object_text = $_[0];
    my @options = @{ $_[1] or [] };
    my @allowed_ops = grep { defined } grep !/^-/, (
        grep {
            my $this = $_;
            not grep /^-$this$/, @options
        } @defaults
    use Safe;
    my $safe_env = Safe->new();
    my $obj = $safe_env->reval($object_text) or die $@;
    if ((grep /^bless$/, @allowed_ops) and ref($obj)) {
        # Safe's restricted environment causes blessed objects to
        # lose their 'magic' when passed back out. Here we simply 
        # re-bless the object to correct that.
        bless $obj, ref($obj);
    return $obj;

use strict;
use Data::Revive;

package Nothing;
sub foo {
        print "foo method called\n";

package main;
use Data::Dumper;
$Data::Dumper::Purity = 1;

print "--- Test Object ---\n";
my $sample_obj = {
    'foo' => {
        'bar' => [0,1,2,3,4]
    'baz' => 12,
    'quux' => "string",
    'quuux' => undef
$sample_obj->{quuuux} = $sample_obj;
my $sample_text = Dumper($sample_obj);
print $sample_text;
print "\n\n";

print "--- Revived Object ---\n";
my $loaded_obj = Data::Revive::revive_object($sample_text);
print Dumper($loaded_obj);
print "\n\n";

print "--- Revived Object with added Opcode ---\n";
my $sample_text2 = Dumper(bless($sample_obj, 'Nothing'));
my $loaded_obj2 = Data::Revive::revive_object($sample_text2, [qw(bless
print Dumper($loaded_obj2);
print "\n\n";

print "--- Revived Object with (intentional) failed Opcode ---\n";
# note, bless not allowed this time
$loaded_obj2 = Data::Revive::revive_object($sample_text2);
print Dumper($loaded_obj2);
print "\n\n";
Replies are listed 'Best First'.
Re: (Yet Another) Safely eval Data::Dumper objects module
by premchai21 (Curate) on Mar 14, 2002 at 19:44 UTC
Re: (Yet Another) Safely eval Data::Dumper objects module
by Felonious (Chaplain) on Mar 14, 2002 at 05:37 UTC
    Sorry, still haven't gotten the hang of posting links yet. The article I tried to reference above is located at if you are interested.

    Update: Fixed the link in the main article

    -- O thievish Night, Why should'st thou, but for some felonious end, In thy dark lantern thus close up the stars? --Milton
Log In?

What's my password?
Create A New User
Node Status?
node history
Node Type: snippet [id://151604]
[atcroft]: stevieb: I have berrybrew installed on a Win machine, and I noticed that with perlbrew you can "upgrade" a particular installed version... any chance of doing something similar in the
[atcroft]: future with berrybrew?
[atcroft]: stevieb: Also, one other odd question... is it possible to set it up so that all the versions installed can use a single directory that they pull module sources into, rather than duplicating files? (Am I making sense, or do I have too high a CBC
[atcroft]: (caffeine-blood content) atm?)

How do I use this? | Other CB clients
Other Users?
Others rifling through the Monastery: (6)
As of 2017-04-29 05:14 GMT
Find Nodes?
    Voting Booth?
    I'm a fool:

    Results (531 votes). Check out past polls.