Security News
Research
Data Theft Repackaged: A Case Study in Malicious Wrapper Packages on npm
The Socket Research Team breaks down a malicious wrapper package that uses obfuscation to harvest credentials and exfiltrate sensitive data.
Jsonic
is a lightweight utility for serializing/deserializing python objects to/from JSON.
Jsonic
targets mainly serialization of data classes
, and aims to make serialization of such classes smooth and painless process.
As a serialization layer on top of your DB layer, or serialization layer for your custom communication protocol
between python micro-services it can do magics
Nevertheless, Jsonic might not be the right tool for serializing your super complex (and awesome) custom data structure to json (although you could probably do it with some extra work)
Some definitions that are used in the rest of this file
jsonic type
jsonic type
is one of the following :
int
float
str
bool
data class
(see definition of data class
below)Serializable
register_serializable_type
@serializer
and @deserializer
was registered fordict
with str
keys that all it's nested values are of jsonic type
list
with which all it's elements are of jsonic type
jsonic representation
jsonic representation
is an output of a successful call of serialize
function on jsonic type
instance
Supported forms of representations:
data class
data class
is any class that answer the next criteria:
__init__
method has no positional-only
parameters__init__
method has *args
or **kwargs
parameters__init__
function has corresponding instance attribute with the same namejsonic type
to jsonic representation
Serializable
or are registered using register_serializable_type
you could
declare instance attributes as transient, so they won't take place in the serialization process@jsonic_serializer
decoratorpython generic dict
or to JSON string
jsonic representation
to jsonic type
instance
Serializable
or are registered using register_serializable_type
you could
create mapping from __init__
parameter name to it's corresponding instance attribute name.
If not mapped, it is assumed __init__
parameter has instance attribute with the same nameJsonic representation
whether it is python generic dict
or JSON string
deserialize
function for type safety.
if the serialized instance was of another type, an error will be thrownClasses extending Serializable
can be serialized into json dict/string representing the object,
and deserialized back to class instance.
Extending classes can declare some attributes as transient. To do so they should have
class attribute:
transient_attributes: List[str]
which should be a list of attributes names that would be transient (won't be serialized and deserialized)
Classes that has __init__
parameter with a different name than it's corresponding instance attribute should have class attribute:
init_parameters_mapping: Dict[str, str]
which should be a dictionary mapping from __init__
parameter name to the corresponding instance attribute name.
When deserializing class instance, the corresponding instance attribute will be passed to the __init__
function.
For __init__
parameter which has no mapping defined, it is assumed that the corresponding instance variable has
the same name as the parameter.
Any nested object in such class must be of jsonic type
Used to register classes that don't extend the Serializable
class, and are not data class
,
therefore optional meta-data is required for them.
This is equivalent to extending Serializable
, but extending Serializable
is preferred when possible.
Most common usage is for classes from external source that you want to serialize, but is a jsonic type
Serializes jsonic type
into jsonic representaion
representing the input
Only jsonic type
can be serialized using this function
Deserializes jsonic representaion
to instance of jsonic type
Only jsonic representation
can be deserialized using this function
Used to register custom serializer for specific type.
These custom serializers are used in the process of serializing jsonic type
Used to register custom deserializer for specific type.
These custom deserializers are used in the process of deserializing jsonic representation
There are few obvious limitations to Jsonic
and a few more subtle ones.
The main source of those limitations is the nature of serialization process in general.
The main focus of Jsonic
is serialization of data classes
, which represents big chunk
of serialization work in general.
jsonic type
's can be serialized.
This means there are classes that cannot be serialized and deserialized using Jsonicdata classes
, and have some technical limitations:
__init__
method has parameters it gets but not persisting as an attribute, it is not jsonic type
even if it meets
all there conditions.
This is because when deserializing a jsonic representation
an instance of the given type must be created.
We need to pass to the constructor the corresponding attributes. Therefore if there are parameters it gets and are not
being persisted into an instance attribute we won't be able to pass them when creating the instance.
Jsonic
won't be able to deserialize this class properly.__init__
method has parameters which are positional-only
parameters, it is not jsonic type
even if it meets
all other conditions.
This is because when deserializing a jsonic representation
an instance of the given type must be created.
We need to pass to the constructor the corresponding attributes. We can pass only keyword arguments which correspond to
an instance attribute.*args and **kwargs
: if a class __init__
method accepts *args or **kwargs, in many cases Jsonic
won't be able to
deserialize it properlyFAQs
lightweight utility for serializing/deserializing python objects to/from JSON
We found that py-jsonic demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Security News
Research
The Socket Research Team breaks down a malicious wrapper package that uses obfuscation to harvest credentials and exfiltrate sensitive data.
Research
Security News
Attackers used a malicious npm package typosquatting a popular ESLint plugin to steal sensitive data, execute commands, and exploit developer systems.
Security News
The Ultralytics' PyPI Package was compromised four times in one weekend through GitHub Actions cache poisoning and failure to rotate previously compromised API tokens.