Repository navigation
Use a safe serialization format for add-on state #19559
Description
Related issues, PRs or discussions
Related #19560
What is the current state of the codebase?
NVDA uses pickle to store the state of add-ons, including whether they're disabled, pending update or removal, or have their compatibility overridden. However, as the documentation states:
The
picklemodule is not secure. Only unpickle data you trust.
Why are changes required?
Since we're persisting data to %appData%, we cannot trust that it hasn't been tampered with.
What technical changes are required?
Rather than using pickle to store the data, use a safe serialisation format like JSON.
Are the proposed technical changes API breaking?
Yes. pickle and JSON are not compatible serialisation formats.
Are there potential risks or issues with the proposed implementation?
We need to migrate old addonsState.pickle files to the new format. This is unlikely to be problematic.
Activity
[-]Use JSON rather than pickle for add-on state[/-][+]Use a safe serialization format for add-on state[/+]Store addons state as JSON (#19564)