{"action":"created","issue":{"url":"https://api.github.com/repos/StackStorm/st2/issues/1761","labels_url":"https://api.github.com/repos/StackStorm/st2/issues/1761/labels{/name}","comments_url":"https://api.github.com/repos/StackStorm/st2/issues/1761/comments","events_url":"https://api.github.com/repos/StackStorm/st2/issues/1761/events","html_url":"https://github.com/StackStorm/st2/issues/1761","id":97972934,"number":1761,"title":"Move from pickle to JSON serializer for message bus messages","user":{"login":"Kami","id":125088,"avatar_url":"https://avatars.githubusercontent.com/u/125088?v=3","gravatar_id":"","url":"https://api.github.com/users/Kami","html_url":"https://github.com/Kami","followers_url":"https://api.github.com/users/Kami/followers","following_url":"https://api.github.com/users/Kami/following{/other_user}","gists_url":"https://api.github.com/users/Kami/gists{/gist_id}","starred_url":"https://api.github.com/users/Kami/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/Kami/subscriptions","organizations_url":"https://api.github.com/users/Kami/orgs","repos_url":"https://api.github.com/users/Kami/repos","events_url":"https://api.github.com/users/Kami/events{/privacy}","received_events_url":"https://api.github.com/users/Kami/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":null,"milestone":null,"comments":1,"created_at":"2015-07-29T16:15:25Z","updated_at":"2015-07-29T17:15:17Z","closed_at":null,"body":"(I've mentioned this multiple times before, but now I'm creating ticket so we can track / prioritize it).\r\n\r\nWe should move from pickle which we use right now to the JSON serializer for the messages which are dispatched on the RabbitMQ message bus.\r\n\r\nUsing pickle is fine if all data which goes through the message bus is controlled and generated by us (and if you don't mind about cross Python version and / or cross programming language compatibility), but this is not the case here (triggers can contain arbitrary data since we poll 3rd systems, etc.). This caries a big risk since if data is maliciously constructed.\r\n\r\nSwitching away from pickle means we won't be able to directly dispatch class instances to the messages bus anymore and we will need to use something like Thrift / Protobus and define structure for all the classes and data we want to pass through the message bus. An alternative would be to write a custom JSON serializer for all the classes we want to dispatch on the message bus, but this requires more work and is less portable then using something like Thrift.\r\n\r\nThat's actually a good thing since those classes will now be decoupled from Python and we will be able to use Thrift / Protobuf definitions to work with them in other languages (e.g. JavaScript)."},"comment":{"url":"https://api.github.com/repos/StackStorm/st2/issues/comments/126023567","html_url":"https://github.com/StackStorm/st2/issues/1761#issuecomment-126023567","issue_url":"https://api.github.com/repos/StackStorm/st2/issues/1761","id":126023567,"user":{"login":"lakshmi-kannan","id":1839421,"avatar_url":"https://avatars.githubusercontent.com/u/1839421?v=3","gravatar_id":"","url":"https://api.github.com/users/lakshmi-kannan","html_url":"https://github.com/lakshmi-kannan","followers_url":"https://api.github.com/users/lakshmi-kannan/followers","following_url":"https://api.github.com/users/lakshmi-kannan/following{/other_user}","gists_url":"https://api.github.com/users/lakshmi-kannan/gists{/gist_id}","starred_url":"https://api.github.com/users/lakshmi-kannan/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/lakshmi-kannan/subscriptions","organizations_url":"https://api.github.com/users/lakshmi-kannan/orgs","repos_url":"https://api.github.com/users/lakshmi-kannan/repos","events_url":"https://api.github.com/users/lakshmi-kannan/events{/privacy}","received_events_url":"https://api.github.com/users/lakshmi-kannan/received_events","type":"User","site_admin":false},"created_at":"2015-07-29T17:15:17Z","updated_at":"2015-07-29T17:15:17Z","body":"+100. "}}