Please replace the use of pickle in subprocess with json.

Um this isn't a duplicate this is addressing a different module to multiprocessing. Currently in subprocess you can almost remove the use of pickle with little to no side-effects.

Can you please re-open this bug ? (unless you feel otherwise).

I don't have 3.3 installed so I cannot test it, but here is a patch for 2.6. I am sure it breaks stuff - are there tests for the subprocess module that would cover the cases that pickle was used for? 


--- subprocess.py.orig	2011-03-02 00:47:59.000000000 +1100
+++ subprocess.py	2011-03-02 00:51:27.000000000 +1100
@@ -414,7 +414,7 @@
     import select
     import errno
     import fcntl
-    import pickle
+    import json
 
 __all__ = ["Popen", "PIPE", "STDOUT", "call", "check_call", "CalledProcessError"]
 
@@ -1105,7 +1105,7 @@
                                                                    exc_value,
                                                                    tb)
                             exc_value.child_traceback = ''.join(exc_lines)
-                            os.write(errpipe_write, pickle.dumps(exc_value))
+                            os.write(errpipe_write, json.dumps(exc_value))
 
                         # This exitcode won't be reported to applications, so it
                         # really doesn't matter what we return.
@@ -1134,7 +1134,7 @@
 
             if data != "":
                 _eintr_retry_call(os.waitpid, self.pid, 0)
-                child_exception = pickle.loads(data)
+                child_exception = json.loads(data)
                 for fd in (p2cwrite, c2pread, errread):
                     if fd is not None:
                         os.close(fd)

Why do you want to replace pickle by json?

From my reading of the code it may be possible if I execute a command via Popen that the child had output that went to stderror, because stderror is associated with the fd of errpipe_write, and it was not to be 'trusted' (lets say I ran it as another user) then it could be pickle.loaded in the parent - and this could potentially be bad.

I could be totally wrong about this tho. I haven't tested the above case yet. 

Regardless - the use of pickle here is not really required and json can do what pickle is doing (from my reading of the code thus far).

Actually I don't think that is possible mmm.

As the child will have already have exec'ed there will be no exception raised --> so the parent shouldn't pickle.load from stderror... So unless there is a path where the parent will end up pickle.load ing the exception that case I put before is not possible.