We have used ZSyncer for 2 years without problem. But, suddenly, it stopped working -- with an obscure "expat: not well formed exception". German special characters turned out to cause this problem. XML-RPC has a big problem when it should work with a both non-ASCII and non-Unicode site as it does not handle encoding of string data (especially, if it does not know the implicit encoding). When we have installed "PyXML" (to get expat, to use "text/xml" with PageTemplates), the "expat" parser started to complain about these non UTF-8 encoded characters. The formerly used parser apparently just ignored such issues. This is the second time that I got bitten by XML-RPC (its sensitivity with respect to "string" data).. I am now convinced that XML-RPC should not be used for Python-Python communication. I made a ZSyncer variant that uses ZPublisher.Client as RPC protocol and Python's "pickle" to marshal data. This gets rid of XML-RPC. If anyone is interested, let me know... -- Dieter
On Thu, Nov 20, 2003 at 07:14:18PM +0100, Dieter Maurer wrote:
I made a ZSyncer variant that uses ZPublisher.Client as RPC protocol and Python's "pickle" to marshal data. This gets rid of XML-RPC. If anyone is interested, let me know...
I would be interested in seeing this. Are you interested in having CVS checkin privileges for zsyncer? If so, tell me your sourceforge ID. You could check in a branch with this version. I'm curious how it compares to the existing zsyncer when syncing tens of megabytes. -- Paul Winkler http://www.slinkp.com Look! Up in the sky! It's THE GHOST-ANUS! (random hero from isometric.spaceninja.com)
On Thu, Nov 20, 2003 at 07:14:18PM +0100, Dieter Maurer wrote:
I made a ZSyncer variant that uses ZPublisher.Client as RPC protocol and Python's "pickle" to marshal data. This gets rid of XML-RPC. If anyone is interested, let me know...
Watch out with pickles; if I can upload an arbitrary pickle to your machine I can get full control of your Zope process, as pickles would allow me to construct arbitrary instances of python objects. -- Martijn Pieters | Software Engineer mailto:mj@zope.com | Zope Corporation http://www.zope.com/ | Creators of Zope http://www.zope.org/ ---------------------------------------------
Martijn Pieters wrote at 2003-11-20 16:21 -0500:
On Thu, Nov 20, 2003 at 07:14:18PM +0100, Dieter Maurer wrote:
I made a ZSyncer variant that uses ZPublisher.Client as RPC protocol and Python's "pickle" to marshal data. This gets rid of XML-RPC. If anyone is interested, let me know...
Watch out with pickles; if I can upload an arbitrary pickle to your machine I can get full control of your Zope process, as pickles would allow me to construct arbitrary instances of python objects.
I can do this with ZSyncer anyway -- even if it uses XML-RPC. Its payload is a pickle that gets imported in the destination. -- Dieter
participants (3)
-
Dieter Maurer -
Martijn Pieters -
Paul Winkler