refactor: change allow_insecure_read to allow_pickle_read

Author: machow

pins/boards.py

@@ -50,7 +50,7 @@ def __init__(
         fs: IFileSystem,
         versioned=True,
         meta_factory=MetaFactory(),
-        allow_insecure_read: "bool | None" = None,
+        allow_pickle_read: "bool | None" = None,
     ):
         self.board = str(board)
         self.fs = fs
@@ -60,7 +60,7 @@ def __init__(
             raise NotImplementedError()
 
         self.versioned = versioned
-        self.allow_insecure_read = allow_insecure_read
+        self.allow_pickle_read = allow_pickle_read
 
     def pin_exists(self, name: str) -> bool:
         """Determine if a pin exists.
@@ -206,7 +206,7 @@ def pin_read(self, name, version: Optional[str] = None, hash: Optional[str] = No
             meta,
             self.fs,
             self.construct_path([pin_name, meta.version.version]),
-            allow_insecure_read=self.allow_insecure_read,
+            allow_pickle_read=self.allow_pickle_read,
         )
 
     def pin_write(
@@ -609,7 +609,7 @@ def pin_download(self, name, version=None, hash=None) -> Sequence[str]:
 
         if isinstance(meta, MetaRaw):
             return load_data(
-                meta, self.fs, None, allow_insecure_read=self.allow_insecure_read
+                meta, self.fs, None, allow_pickle_read=self.allow_pickle_read
             )
 
         raise NotImplementedError("TODO: allow download beyond MetaRaw.")

pins/config.py

@@ -4,7 +4,7 @@
 PINS_NAME = "pins-py"
 PINS_ENV_DATA_DIR = "PINS_DATA_DIR"
 PINS_ENV_CACHE_DIR = "PINS_CACHE_DIR"
-PINS_ENV_INSECURE_READ = "PINS_ALLOW_INSECURE_READ"
+PINS_ENV_INSECURE_READ = "PINS_ALLOW_PICKLE_READ"
 
 
 def get_data_dir():
@@ -15,7 +15,7 @@ def get_cache_dir():
     return os.environ.get(PINS_ENV_CACHE_DIR, appdirs.user_cache_dir(PINS_NAME))
 
 
-def get_allow_insecure_read(flag):
+def get_allow_pickle_read(flag):
     if flag is None:
         env_var = os.environ.get(PINS_ENV_INSECURE_READ, "0")
         try:

pins/drivers.py

@@ -2,7 +2,7 @@
 
 from pathlib import Path
 
-from .config import get_allow_insecure_read, PINS_ENV_INSECURE_READ
+from .config import get_allow_pickle_read, PINS_ENV_INSECURE_READ
 from .meta import Meta
 from .errors import PinsInsecureReadError
 
@@ -17,7 +17,7 @@ def load_data(
     meta: Meta,
     fs,
     path_to_version: "str | None" = None,
-    allow_insecure_read: "bool | None" = None,
+    allow_pickle_read: "bool | None" = None,
 ):
     """Return loaded data, based on meta type.
     Parameters
@@ -30,10 +30,11 @@ def load_data(
         A filepath used as the parent directory the data to-be-loaded lives in.
     """
     # TODO: extandable loading with deferred importing
-    if meta.type in UNSAFE_TYPES and not get_allow_insecure_read(allow_insecure_read):
+    if meta.type in UNSAFE_TYPES and not get_allow_pickle_read(allow_pickle_read):
         raise PinsInsecureReadError(
-            f"Reading pin type {meta.type} is NOT secure. Set the allow_insecure_read=True "
-            f"when creating the board, or the {PINS_ENV_INSECURE_READ}=1 environment variable.\n"
+            f"Reading pin type {meta.type} involves reading a pickle file, so is NOT secure."
+            f"Set the allow_pickle_read=True when creating the board, or the "
+            f"{PINS_ENV_INSECURE_READ}=1 environment variable.\n"
             "See:\n"
             "  * https://docs.python.org/3/library/pickle.html \n"
             "  * https://scikit-learn.org/stable/modules/model_persistence.html#security-maintainability-limitations"

pins/tests/test_boards.py

@@ -5,6 +5,7 @@
 import pytest
 
 from pins.tests.helpers import DEFAULT_CREATION_DATE, rm_env
+from pins.config import PINS_ENV_INSECURE_READ
 from pins.errors import PinsError, PinsInsecureReadError
 from pins.meta import MetaRaw
 
@@ -112,8 +113,8 @@ def test_board_pin_write_rsc_index_html(board, tmp_dir2, snapshot):
     "obj, type_", [(df, "csv"), (df, "joblib"), ({"a": 1, "b": [2, 3]}, "joblib")]
 )
 def test_board_pin_write_type(board, obj, type_, request):
-    with rm_env("PINS_ALLOW_INSECURE_READ"):
-        os.environ["PINS_ALLOW_INSECURE_READ"] = "1"
+    with rm_env(PINS_ENV_INSECURE_READ):
+        os.environ[PINS_ENV_INSECURE_READ] = "1"
         meta = board.pin_write(obj, "test_pin", type=type_, title="some title")
         dst_obj = board.pin_read("test_pin")
 
@@ -135,19 +136,19 @@ def test_board_pin_read_insecure_fail_default(board):
 
 def test_board_pin_read_insecure_fail_board_flag(board):
     # board flag prioritized over env var
-    with rm_env("PINS_ALLOW_INSECURE_READ"):
-        os.environ["PINS_ALLOW_INSECURE_READ"] = "1"
-        board.allow_insecure_read = False
+    with rm_env(PINS_ENV_INSECURE_READ):
+        os.environ[PINS_ENV_INSECURE_READ] = "1"
+        board.allow_pickle_read = False
         board.pin_write({"a": 1}, "test_pin", type="joblib", title="some title")
         with pytest.raises(PinsInsecureReadError):
             board.pin_read("test_pin")
 
 
 def test_board_pin_read_insecure_succeed_board_flag(board):
     # board flag prioritized over env var
-    with rm_env("PINS_ALLOW_INSECURE_READ"):
-        os.environ["PINS_ALLOW_INSECURE_READ"] = "0"
-        board.allow_insecure_read = True
+    with rm_env(PINS_ENV_INSECURE_READ):
+        os.environ[PINS_ENV_INSECURE_READ] = "0"
+        board.allow_pickle_read = True
         board.pin_write({"a": 1}, "test_pin", type="joblib", title="some title")
         board.pin_read("test_pin")
 

pins/tests/test_config.py

@@ -15,22 +15,22 @@ def env_unset():
         yield
 
 
-def test_allow_insecure_read_no_env(env_unset):
-    assert config.get_allow_insecure_read(True) is True
-    assert config.get_allow_insecure_read(False) is False
+def test_allow_pickle_read_no_env(env_unset):
+    assert config.get_allow_pickle_read(True) is True
+    assert config.get_allow_pickle_read(False) is False
 
 
-def test_allow_insecure_read_env_1(env_unset):
+def test_allow_pickle_read_env_1(env_unset):
     os.environ[config.PINS_ENV_INSECURE_READ] = "1"
 
-    assert config.get_allow_insecure_read(True) is True
-    assert config.get_allow_insecure_read(False) is False
-    assert config.get_allow_insecure_read(None) is True
+    assert config.get_allow_pickle_read(True) is True
+    assert config.get_allow_pickle_read(False) is False
+    assert config.get_allow_pickle_read(None) is True
 
 
-def test_allow_insecure_read_env_0(env_unset):
+def test_allow_pickle_read_env_0(env_unset):
     os.environ[config.PINS_ENV_INSECURE_READ] = "0"
 
-    assert config.get_allow_insecure_read(True) is True
-    assert config.get_allow_insecure_read(False) is False
-    assert config.get_allow_insecure_read(None) is False
+    assert config.get_allow_pickle_read(True) is True
+    assert config.get_allow_pickle_read(False) is False
+    assert config.get_allow_pickle_read(None) is False