{ "content": [ { "type": "text", "text": "# Storable (man)\n\n## NAME\n\nStorable - persistence for Perl data structures\n\n## SYNOPSIS\n\nuse Storable;\nstore \\%table, 'file';\n$hashref = retrieve('file');\nuse Storable qw(nstore storefd nstorefd freeze thaw dclone);\n# Network order\nnstore \\%table, 'file';\n$hashref = retrieve('file'); # There is NO nretrieve()\n# Storing to and retrieving from an already opened file\nstorefd \\@array, \\*STDOUT;\nnstorefd \\%table, \\*STDOUT;\n$aryref = fdretrieve(\\*SOCKET);\n$hashref = fdretrieve(\\*SOCKET);\n# Serializing to memory\n$serialized = freeze \\%table;\n%tableclone = %{ thaw($serialized) };\n# Deep (recursive) cloning\n$cloneref = dclone($ref);\n# Advisory locking\nuse Storable qw(lockstore locknstore lockretrieve)\nlockstore \\%table, 'file';\nlocknstore \\%table, 'file';\n$hashref = lockretrieve('file');\n\n## DESCRIPTION\n\nThe Storable package brings persistence to your Perl data structures containing SCALAR,\nARRAY, HASH or REF objects, i.e. anything that can be conveniently stored to disk and\nretrieved at a later time.\n\n## Sections\n\n- **NAME**\n- **SYNOPSIS**\n- **DESCRIPTION**\n- **MEMORY STORE**\n- **ADVISORY LOCKING**\n- **SPEED**\n- **CANONICAL REPRESENTATION**\n- **CODE REFERENCES**\n- **FORWARD COMPATIBILITY**\n- **ERROR REPORTING**\n- **WIZARDS ONLY** (5 subsections)\n- **EXAMPLES**\n- **SECURITY WARNING** (1 subsections)\n- **WARNING**\n- **REGULAR EXPRESSIONS**\n- **BUGS** (1 subsections)\n- **CREDITS**\n- **AUTHOR**\n- **SEE ALSO**\n\nUse structuredContent.sections for detailed options, examples, and full documentation.\n" } ], "structuredContent": { "command": "Storable", "section": "", "mode": "man", "summary": "Storable - persistence for Perl data structures", "synopsis": "use Storable;\nstore \\%table, 'file';\n$hashref = retrieve('file');\nuse Storable qw(nstore storefd nstorefd freeze thaw dclone);\n# Network order\nnstore \\%table, 'file';\n$hashref = retrieve('file'); # There is NO nretrieve()\n# Storing to and retrieving from an already opened file\nstorefd \\@array, \\*STDOUT;\nnstorefd \\%table, \\*STDOUT;\n$aryref = fdretrieve(\\*SOCKET);\n$hashref = fdretrieve(\\*SOCKET);\n# Serializing to memory\n$serialized = freeze \\%table;\n%tableclone = %{ thaw($serialized) };\n# Deep (recursive) cloning\n$cloneref = dclone($ref);\n# Advisory locking\nuse Storable qw(lockstore locknstore lockretrieve)\nlockstore \\%table, 'file';\nlocknstore \\%table, 'file';\n$hashref = lockretrieve('file');", "tldr_summary": null, "tldr_examples": [], "tldr_source": null, "flags": [], "examples": [ "Here are some code samples showing a possible usage of Storable:", "use Storable qw(store retrieve freeze thaw dclone);", "%color = ('Blue' => 0.1, 'Red' => 0.8, 'Black' => 0, 'White' => 1);", "store(\\%color, 'mycolors') or die \"Can't store %a in mycolors!\\n\";", "$colref = retrieve('mycolors');", "die \"Unable to retrieve from mycolors!\\n\" unless defined $colref;", "printf \"Blue is still %lf\\n\", $colref->{'Blue'};", "$colref2 = dclone(\\%color);", "$str = freeze(\\%color);", "printf \"Serialization of %%color is %d bytes long.\\n\", length($str);", "$colref3 = thaw($str);", "which prints (on my machine):", "Blue is still 0.100000", "Serialization of %color is 102 bytes long.", "Serialization of CODE references and deserialization in a safe compartment:", "use Storable qw(freeze thaw);", "use Safe;", "use strict;", "my $safe = new Safe;", "# because of opcodes used in \"use strict\":", "$safe->permit(qw(:default require));", "local $Storable::Deparse = 1;", "local $Storable::Eval = sub { $safe->reval($[0]) };", "my $serialized = freeze(sub { 42 });", "my $code = thaw($serialized);", "$code->() == 42;" ], "see_also": [], "section_outline": [ { "name": "NAME", "lines": 2, "subsections": [] }, { "name": "SYNOPSIS", "lines": 29, "subsections": [] }, { "name": "DESCRIPTION", "lines": 45, "subsections": [] }, { "name": "MEMORY STORE", "lines": 18, "subsections": [] }, { "name": "ADVISORY LOCKING", "lines": 13, "subsections": [] }, { "name": "SPEED", "lines": 4, "subsections": [] }, { "name": "CANONICAL REPRESENTATION", "lines": 8, "subsections": [] }, { "name": "CODE REFERENCES", "lines": 10, "subsections": [] }, { "name": "FORWARD COMPATIBILITY", "lines": 54, "subsections": [] }, { "name": "ERROR REPORTING", "lines": 16, "subsections": [] }, { "name": "WIZARDS ONLY", "lines": 1, "subsections": [ { "name": "Hooks", "lines": 107 }, { "name": "Predicates", "lines": 14 }, { "name": "Recursion", "lines": 61 }, { "name": "Deep Cloning", "lines": 5 }, { "name": "Storable magic", "lines": 85 } ] }, { "name": "EXAMPLES", "lines": 37, "subsections": [] }, { "name": "SECURITY WARNING", "lines": 1, "subsections": [ { "name": "Do not accept Storable documents from untrusted sources!", "lines": 25 } ] }, { "name": "WARNING", "lines": 20, "subsections": [] }, { "name": "REGULAR EXPRESSIONS", "lines": 17, "subsections": [] }, { "name": "BUGS", "lines": 34, "subsections": [ { "name": "64 bit data in perl 5.6.0 and 5.6.1", "lines": 45 } ] }, { "name": "CREDITS", "lines": 32, "subsections": [] }, { "name": "AUTHOR", "lines": 7, "subsections": [] }, { "name": "SEE ALSO", "lines": 5, "subsections": [] } ], "sections": { "NAME": { "content": "Storable - persistence for Perl data structures\n", "subsections": [] }, "SYNOPSIS": { "content": "use Storable;\nstore \\%table, 'file';\n$hashref = retrieve('file');\n\nuse Storable qw(nstore storefd nstorefd freeze thaw dclone);\n\n# Network order\nnstore \\%table, 'file';\n$hashref = retrieve('file'); # There is NO nretrieve()\n\n# Storing to and retrieving from an already opened file\nstorefd \\@array, \\*STDOUT;\nnstorefd \\%table, \\*STDOUT;\n$aryref = fdretrieve(\\*SOCKET);\n$hashref = fdretrieve(\\*SOCKET);\n\n# Serializing to memory\n$serialized = freeze \\%table;\n%tableclone = %{ thaw($serialized) };\n\n# Deep (recursive) cloning\n$cloneref = dclone($ref);\n\n# Advisory locking\nuse Storable qw(lockstore locknstore lockretrieve)\nlockstore \\%table, 'file';\nlocknstore \\%table, 'file';\n$hashref = lockretrieve('file');\n", "subsections": [] }, "DESCRIPTION": { "content": "The Storable package brings persistence to your Perl data structures containing SCALAR,\nARRAY, HASH or REF objects, i.e. anything that can be conveniently stored to disk and\nretrieved at a later time.\n\nIt can be used in the regular procedural way by calling \"store\" with a reference to the\nobject to be stored, along with the file name where the image should be written.\n\nThe routine returns \"undef\" for I/O problems or other internal error, a true value otherwise.\nSerious errors are propagated as a \"die\" exception.\n\nTo retrieve data stored to disk, use \"retrieve\" with a file name. The objects stored into\nthat file are recreated into memory for you, and a reference to the root object is returned.\nIn case an I/O error occurs while reading, \"undef\" is returned instead. Other serious errors\nare propagated via \"die\".\n\nSince storage is performed recursively, you might want to stuff references to objects that\nshare a lot of common data into a single array or hash table, and then store that object.\nThat way, when you retrieve back the whole thing, the objects will continue to share what\nthey originally shared.\n\nAt the cost of a slight header overhead, you may store to an already opened file descriptor\nusing the \"storefd\" routine, and retrieve from a file via \"fdretrieve\". Those names aren't\nimported by default, so you will have to do that explicitly if you need those routines. The\nfile descriptor you supply must be already opened, for read if you're going to retrieve and\nfor write if you wish to store.\n\nstorefd(\\%table, *STDOUT) || die \"can't store to stdout\\n\";\n$hashref = fdretrieve(*STDIN);\n\nYou can also store data in network order to allow easy sharing across multiple platforms, or\nwhen storing on a socket known to be remotely connected. The routines to call have an initial\n\"n\" prefix for network, as in \"nstore\" and \"nstorefd\". At retrieval time, your data will be\ncorrectly restored so you don't have to know whether you're restoring from native or network\nordered data. Double values are stored stringified to ensure portability as well, at the\nslight risk of loosing some precision in the last decimals.\n\nWhen using \"fdretrieve\", objects are retrieved in sequence, one object (i.e. one recursive\ntree) per associated \"storefd\".\n\nIf you're more from the object-oriented camp, you can inherit from Storable and directly\nstore your objects by invoking \"store\" as a method. The fact that the root of the to-be-\nstored tree is a blessed reference (i.e. an object) is special-cased so that the retrieve\ndoes not provide a reference to that object but rather the blessed object reference itself.\n(Otherwise, you'd get a reference to that blessed object).\n", "subsections": [] }, "MEMORY STORE": { "content": "The Storable engine can also store data into a Perl scalar instead, to later retrieve them.\nThis is mainly used to freeze a complex structure in some safe compact memory place (where it\ncan possibly be sent to another process via some IPC, since freezing the structure also\nserializes it in effect). Later on, and maybe somewhere else, you can thaw the Perl scalar\nout and recreate the original complex structure in memory.\n\nSurprisingly, the routines to be called are named \"freeze\" and \"thaw\". If you wish to send\nout the frozen scalar to another machine, use \"nfreeze\" instead to get a portable image.\n\nNote that freezing an object structure and immediately thawing it actually achieves a deep\ncloning of that structure:\n\ndclone(.) = thaw(freeze(.))\n\nStorable provides you with a \"dclone\" interface which does not create that intermediary\nscalar but instead freezes the structure in some internal memory space and then immediately\nthaws it out.\n", "subsections": [] }, "ADVISORY LOCKING": { "content": "The \"lockstore\" and \"locknstore\" routine are equivalent to \"store\" and \"nstore\", except\nthat they get an exclusive lock on the file before writing. Likewise, \"lockretrieve\" does\nthe same as \"retrieve\", but also gets a shared lock on the file before reading.\n\nAs with any advisory locking scheme, the protection only works if you systematically use\n\"lockstore\" and \"lockretrieve\". If one side of your application uses \"store\" whilst the\nother uses \"lockretrieve\", you will get no protection at all.\n\nThe internal advisory locking is implemented using Perl's flock() routine. If your system\ndoes not support any form of flock(), or if you share your files across NFS, you might wish\nto use other forms of locking by using modules such as LockFile::Simple which lock a file\nusing a filesystem entry, instead of locking the file descriptor.\n", "subsections": [] }, "SPEED": { "content": "The heart of Storable is written in C for decent speed. Extra low-level optimizations have\nbeen made when manipulating perl internals, to sacrifice encapsulation for the benefit of\ngreater speed.\n", "subsections": [] }, "CANONICAL REPRESENTATION": { "content": "Normally, Storable stores elements of hashes in the order they are stored internally by Perl,\ni.e. pseudo-randomly. If you set $Storable::canonical to some \"TRUE\" value, Storable will\nstore hashes with the elements sorted by their key. This allows you to compare data\nstructures by comparing their frozen representations (or even the compressed frozen\nrepresentations), which can be useful for creating lookup tables for complicated queries.\n\nCanonical order does not imply network order; those are two orthogonal settings.\n", "subsections": [] }, "CODE REFERENCES": { "content": "Since Storable version 2.05, CODE references may be serialized with the help of B::Deparse.\nTo enable this feature, set $Storable::Deparse to a true value. To enable deserialization,\n$Storable::Eval should be set to a true value. Be aware that deserialization is done through\n\"eval\", which is dangerous if the Storable file contains malicious data. You can set\n$Storable::Eval to a subroutine reference which would be used instead of \"eval\". See below\nfor an example using a Safe compartment for deserialization of CODE references.\n\nIf $Storable::Deparse and/or $Storable::Eval are set to false values, then the value of\n$Storable::forgiveme (see below) is respected while serializing and deserializing.\n", "subsections": [] }, "FORWARD COMPATIBILITY": { "content": "This release of Storable can be used on a newer version of Perl to serialize data which is\nnot supported by earlier Perls. By default, Storable will attempt to do the right thing, by\n\"croak()\"ing if it encounters data that it cannot deserialize. However, the defaults can be\nchanged as follows:\n\nutf8 data\nPerl 5.6 added support for Unicode characters with code points > 255, and Perl 5.8 has\nfull support for Unicode characters in hash keys. Perl internally encodes strings with\nthese characters using utf8, and Storable serializes them as utf8. By default, if an\nolder version of Perl encounters a utf8 value it cannot represent, it will \"croak()\". To\nchange this behaviour so that Storable deserializes utf8 encoded values as the string of\nbytes (effectively dropping the isutf8 flag) set $Storable::droputf8 to some \"TRUE\"\nvalue. This is a form of data loss, because with $droputf8 true, it becomes impossible\nto tell whether the original data was the Unicode string, or a series of bytes that\nhappen to be valid utf8.\n\nrestricted hashes\nPerl 5.8 adds support for restricted hashes, which have keys restricted to a given set,\nand can have values locked to be read only. By default, when Storable encounters a\nrestricted hash on a perl that doesn't support them, it will deserialize it as a normal\nhash, silently discarding any placeholder keys and leaving the keys and all values\nunlocked. To make Storable \"croak()\" instead, set $Storable::downgraderestricted to a\n\"FALSE\" value. To restore the default set it back to some \"TRUE\" value.\n\nThe cperl PERLPERTURBKEYSTOP hash strategy has a known problem with restricted hashes.\n\nhuge objects\nOn 64bit systems some data structures may exceed the 2G (i.e. I32MAX) limit. On 32bit\nsystems also strings between I32 and U32 (2G-4G). Since Storable 3.00 (not in perl5\ncore) we are able to store and retrieve these objects, even if perl5 itself is not able\nto handle them. These are strings longer then 4G, arrays with more then 2G elements and\nhashes with more then 2G elements. cperl forbids hashes with more than 2G elements, but\nthis fail in cperl then. perl5 itself at least until 5.26 allows it, but cannot iterate\nover them. Note that creating those objects might cause out of memory exceptions by the\noperating system before perl has a chance to abort.\n\nfiles from future versions of Storable\nEarlier versions of Storable would immediately croak if they encountered a file with a\nhigher internal version number than the reading Storable knew about. Internal version\nnumbers are increased each time new data types (such as restricted hashes) are added to\nthe vocabulary of the file format. This meant that a newer Storable module had no way of\nwriting a file readable by an older Storable, even if the writer didn't store newer data\ntypes.\n\nThis version of Storable will defer croaking until it encounters a data type in the file\nthat it does not recognize. This means that it will continue to read files generated by\nnewer Storable modules which are careful in what they write out, making it easier to\nupgrade Storable modules in a mixed environment.\n\nThe old behaviour of immediate croaking can be re-instated by setting\n$Storable::acceptfutureminor to some \"FALSE\" value.\n\nAll these variables have no effect on a newer Perl which supports the relevant feature.\n", "subsections": [] }, "ERROR REPORTING": { "content": "Storable uses the \"exception\" paradigm, in that it does not try to workaround failures: if\nsomething bad happens, an exception is generated from the caller's perspective (see Carp and\n\"croak()\"). Use eval {} to trap those exceptions.\n\nWhen Storable croaks, it tries to report the error via the \"logcroak()\" routine from the\n\"Log::Agent\" package, if it is available.\n\nNormal errors are reported by having store() or retrieve() return \"undef\". Such errors are\nusually I/O errors (or truncated stream errors at retrieval).\n\nWhen Storable throws the \"Max. recursion depth with nested structures exceeded\" error we are\nalready out of stack space. Unfortunately on some earlier perl versions cleaning up a\nrecursive data structure recurses into the free calls, which will lead to stack overflows in\nthe cleanup. This data structure is not properly cleaned up then, it will only be destroyed\nduring global destruction.\n", "subsections": [] }, "WIZARDS ONLY": { "content": "", "subsections": [ { "name": "Hooks", "content": "Any class may define hooks that will be called during the serialization and deserialization\nprocess on objects that are instances of that class. Those hooks can redefine the way\nserialization is performed (and therefore, how the symmetrical deserialization should be\nconducted).\n\nSince we said earlier:\n\ndclone(.) = thaw(freeze(.))\n\neverything we say about hooks should also hold for deep cloning. However, hooks get to know\nwhether the operation is a mere serialization, or a cloning.\n\nTherefore, when serializing hooks are involved,\n\ndclone(.) <> thaw(freeze(.))\n\nWell, you could keep them in sync, but there's no guarantee it will always hold on classes\nsomebody else wrote. Besides, there is little to gain in doing so: a serializing hook could\nkeep only one attribute of an object, which is probably not what should happen during a deep\ncloning of that same object.\n\nHere is the hooking interface:\n\n\"STORABLEfreeze\" obj, cloning\nThe serializing hook, called on the object during serialization. It can be inherited, or\ndefined in the class itself, like any other method.\n\nArguments: obj is the object to serialize, cloning is a flag indicating whether we're in\na dclone() or a regular serialization via store() or freeze().\n\nReturned value: A LIST \"($serialized, $ref1, $ref2, ...)\" where $serialized is the\nserialized form to be used, and the optional $ref1, $ref2, etc... are extra references\nthat you wish to let the Storable engine serialize.\n\nAt deserialization time, you will be given back the same LIST, but all the extra\nreferences will be pointing into the deserialized structure.\n\nThe first time the hook is hit in a serialization flow, you may have it return an empty\nlist. That will signal the Storable engine to further discard that hook for this class\nand to therefore revert to the default serialization of the underlying Perl data. The\nhook will again be normally processed in the next serialization.\n\nUnless you know better, serializing hook should always say:\n\nsub STORABLEfreeze {\nmy ($self, $cloning) = @;\nreturn if $cloning; # Regular default serialization\n....\n}\n\nin order to keep reasonable dclone() semantics.\n\n\"STORABLEthaw\" obj, cloning, serialized, ...\nThe deserializing hook called on the object during deserialization. But wait: if we're\ndeserializing, there's no object yet... right?\n\nWrong: the Storable engine creates an empty one for you. If you know Eiffel, you can\nview \"STORABLEthaw\" as an alternate creation routine.\n\nThis means the hook can be inherited like any other method, and that obj is your blessed\nreference for this particular instance.\n\nThe other arguments should look familiar if you know \"STORABLEfreeze\": cloning is true\nwhen we're part of a deep clone operation, serialized is the serialized string you\nreturned to the engine in \"STORABLEfreeze\", and there may be an optional list of\nreferences, in the same order you gave them at serialization time, pointing to the\ndeserialized objects (which have been processed courtesy of the Storable engine).\n\nWhen the Storable engine does not find any \"STORABLEthaw\" hook routine, it tries to load\nthe class by requiring the package dynamically (using the blessed package name), and then\nre-attempts the lookup. If at that time the hook cannot be located, the engine croaks.\nNote that this mechanism will fail if you define several classes in the same file, but\nperlmod warned you.\n\nIt is up to you to use this information to populate obj the way you want.\n\nReturned value: none.\n\n\"STORABLEattach\" class, cloning, serialized\nWhile \"STORABLEfreeze\" and \"STORABLEthaw\" are useful for classes where each instance is\nindependent, this mechanism has difficulty (or is incompatible) with objects that exist\nas common process-level or system-level resources, such as singleton objects, database\npools, caches or memoized objects.\n\nThe alternative \"STORABLEattach\" method provides a solution for these shared objects.\nInstead of \"STORABLEfreeze\" --> \"STORABLEthaw\", you implement \"STORABLEfreeze\" -->\n\"STORABLEattach\" instead.\n\nArguments: class is the class we are attaching to, cloning is a flag indicating whether\nwe're in a dclone() or a regular de-serialization via thaw(), and serialized is the\nstored string for the resource object.\n\nBecause these resource objects are considered to be owned by the entire process/system,\nand not the \"property\" of whatever is being serialized, no references underneath the\nobject should be included in the serialized string. Thus, in any class that implements\n\"STORABLEattach\", the \"STORABLEfreeze\" method cannot return any references, and\n\"Storable\" will throw an error if \"STORABLEfreeze\" tries to return references.\n\nAll information required to \"attach\" back to the shared resource object must be contained\nonly in the \"STORABLEfreeze\" return string. Otherwise, \"STORABLEfreeze\" behaves as\nnormal for \"STORABLEattach\" classes.\n\nBecause \"STORABLEattach\" is passed the class (rather than an object), it also returns\nthe object directly, rather than modifying the passed object.\n\nReturned value: object of type \"class\"\n" }, { "name": "Predicates", "content": "Predicates are not exportable. They must be called by explicitly prefixing them with the\nStorable package name.\n\n\"Storable::lastopinnetorder\"\nThe \"Storable::lastopinnetorder()\" predicate will tell you whether network order was\nused in the last store or retrieve operation. If you don't know how to use this, just\nforget about it.\n\n\"Storable::isstoring\"\nReturns true if within a store operation (via STORABLEfreeze hook).\n\n\"Storable::isretrieving\"\nReturns true if within a retrieve operation (via STORABLEthaw hook).\n" }, { "name": "Recursion", "content": "With hooks comes the ability to recurse back to the Storable engine. Indeed, hooks are\nregular Perl code, and Storable is convenient when it comes to serializing and deserializing\nthings, so why not use it to handle the serialization string?\n\nThere are a few things you need to know, however:\n\n• From Storable 3.05 to 3.13 we probed for the stack recursion limit for references, arrays\nand hashes to a maximal depth of ~1200-35000, otherwise we might fall into a stack-\noverflow. On JSON::XS this limit is 512 btw. With references not immediately\nreferencing each other there's no such limit yet, so you might fall into such a stack-\noverflow segfault.\n\nThis probing and the checks we performed have some limitations:\n\n• the stack size at build time might be different at run time, eg. the stack size may\nhave been modified with ulimit(1). If it's larger at run time Storable may fail the\nfreeze() or thaw() unnecessarily. If it's larger at build time Storable may\nsegmentation fault when processing a deep structure at run time.\n\n• the stack size might be different in a thread.\n\n• array and hash recursion limits are checked separately against the same recursion\ndepth, a frozen structure with a large sequence of nested arrays within many nested\nhashes may exhaust the processor stack without triggering Storable's recursion\nprotection.\n\nSo these now have simple defaults rather than probing at build-time.\n\nYou can control the maximum array and hash recursion depths by modifying\n$Storable::recursionlimit and $Storable::recursionlimithash respectively. Either can\nbe set to \"-1\" to prevent any depth checks, though this isn't recommended.\n\nIf you want to test what the limits are, the stacksize tool is included in the \"Storable\"\ndistribution.\n\n• You can create endless loops if the things you serialize via freeze() (for instance)\npoint back to the object we're trying to serialize in the hook.\n\n• Shared references among objects will not stay shared: if we're serializing the list of\nobject [A, C] where both object A and C refer to the SAME object B, and if there is a\nserializing hook in A that says freeze(B), then when deserializing, we'll get [A', C']\nwhere A' refers to B', but C' refers to D, a deep clone of B'. The topology was not\npreserved.\n\n• The maximal stack recursion limit for your system is returned by \"stackdepth()\" and\n\"stackdepthhash()\". The hash limit is usually half the size of the array and ref limit,\nas the Perl hash API is not optimal.\n\nThat's why \"STORABLEfreeze\" lets you provide a list of references to serialize. The engine\nguarantees that those will be serialized in the same context as the other objects, and\ntherefore that shared objects will stay shared.\n\nIn the above [A, C] example, the \"STORABLEfreeze\" hook could return:\n\n(\"something\", $self->{B})\n\nand the B part would be serialized by the engine. In \"STORABLEthaw\", you would get back the\nreference to the B' object, deserialized for you.\n\nTherefore, recursion should normally be avoided, but is nonetheless supported.\n" }, { "name": "Deep Cloning", "content": "There is a Clone module available on CPAN which implements deep cloning natively, i.e.\nwithout freezing to memory and thawing the result. It is aimed to replace Storable's\ndclone() some day. However, it does not currently support Storable hooks to redefine the way\ndeep cloning is performed.\n" }, { "name": "Storable magic", "content": "Yes, there's a lot of that :-) But more precisely, in UNIX systems there's a utility called\n\"file\", which recognizes data files based on their contents (usually their first few bytes).\nFor this to work, a certain file called magic needs to taught about the signature of the\ndata. Where that configuration file lives depends on the UNIX flavour; often it's something\nlike /usr/share/misc/magic or /etc/magic. Your system administrator needs to do the updating\nof the magic file. The necessary signature information is output to STDOUT by invoking\nStorable::showfilemagic(). Note that the GNU implementation of the \"file\" utility, version\n3.38 or later, is expected to contain support for recognising Storable files out-of-the-box,\nin addition to other kinds of Perl files.\n\nYou can also use the following functions to extract the file header information from Storable\nimages:\n\n$info = Storable::filemagic( $filename )\nIf the given file is a Storable image return a hash describing it. If the file is\nreadable, but not a Storable image return \"undef\". If the file does not exist or is\nunreadable then croak.\n\nThe hash returned has the following elements:\n\n\"version\"\nThis returns the file format version. It is a string like \"2.7\".\n\nNote that this version number is not the same as the version number of the Storable\nmodule itself. For instance Storable v0.7 create files in format v2.0 and Storable\nv2.15 create files in format v2.7. The file format version number only increment\nwhen additional features that would confuse older versions of the module are added.\n\nFiles older than v2.0 will have the one of the version numbers \"-1\", \"0\" or \"1\". No\nminor number was used at that time.\n\n\"versionnv\"\nThis returns the file format version as number. It is a string like \"2.007\". This\nvalue is suitable for numeric comparisons.\n\nThe constant function \"Storable::BINVERSIONNV\" returns a comparable number that\nrepresents the highest file version number that this version of Storable fully\nsupports (but see discussion of $Storable::acceptfutureminor above). The constant\n\"Storable::BINWRITEVERSIONNV\" function returns what file version is written and\nmight be less than \"Storable::BINVERSIONNV\" in some configurations.\n\n\"major\", \"minor\"\nThis also returns the file format version. If the version is \"2.7\" then major would\nbe 2 and minor would be 7. The minor element is missing for when major is less than\n2.\n\n\"hdrsize\"\nThe is the number of bytes that the Storable header occupies.\n\n\"netorder\"\nThis is TRUE if the image store data in network order. This means that it was\ncreated with nstore() or similar.\n\n\"byteorder\"\nThis is only present when \"netorder\" is FALSE. It is the $Config{byteorder} string\nof the perl that created this image. It is a string like \"1234\" (32 bit little\nendian) or \"87654321\" (64 bit big endian). This must match the current perl for the\nimage to be readable by Storable.\n\n\"intsize\", \"longsize\", \"ptrsize\", \"nvsize\"\nThese are only present when \"netorder\" is FALSE. These are the sizes of various C\ndatatypes of the perl that created this image. These must match the current perl for\nthe image to be readable by Storable.\n\nThe \"nvsize\" element is only present for file format v2.2 and higher.\n\n\"file\"\nThe name of the file.\n\n$info = Storable::readmagic( $buffer )\n$info = Storable::readmagic( $buffer, $mustbefile )\nThe $buffer should be a Storable image or the first few bytes of it. If $buffer starts\nwith a Storable header, then a hash describing the image is returned, otherwise \"undef\"\nis returned.\n\nThe hash has the same structure as the one returned by Storable::filemagic(). The\n\"file\" element is true if the image is a file image.\n\nIf the $mustbefile argument is provided and is TRUE, then return \"undef\" unless the\nimage looks like it belongs to a file dump.\n\nThe maximum size of a Storable header is currently 21 bytes. If the provided $buffer is\nonly the first part of a Storable image it should at least be this long to ensure that\nreadmagic() will recognize it as such.\n" } ] }, "EXAMPLES": { "content": "Here are some code samples showing a possible usage of Storable:\n\nuse Storable qw(store retrieve freeze thaw dclone);\n\n%color = ('Blue' => 0.1, 'Red' => 0.8, 'Black' => 0, 'White' => 1);\n\nstore(\\%color, 'mycolors') or die \"Can't store %a in mycolors!\\n\";\n\n$colref = retrieve('mycolors');\ndie \"Unable to retrieve from mycolors!\\n\" unless defined $colref;\nprintf \"Blue is still %lf\\n\", $colref->{'Blue'};\n\n$colref2 = dclone(\\%color);\n\n$str = freeze(\\%color);\nprintf \"Serialization of %%color is %d bytes long.\\n\", length($str);\n$colref3 = thaw($str);\n\nwhich prints (on my machine):\n\nBlue is still 0.100000\nSerialization of %color is 102 bytes long.\n\nSerialization of CODE references and deserialization in a safe compartment:\n\nuse Storable qw(freeze thaw);\nuse Safe;\nuse strict;\nmy $safe = new Safe;\n# because of opcodes used in \"use strict\":\n$safe->permit(qw(:default require));\nlocal $Storable::Deparse = 1;\nlocal $Storable::Eval = sub { $safe->reval($[0]) };\nmy $serialized = freeze(sub { 42 });\nmy $code = thaw($serialized);\n$code->() == 42;\n", "subsections": [] }, "SECURITY WARNING": { "content": "", "subsections": [ { "name": "Do not accept Storable documents from untrusted sources!", "content": "Some features of Storable can lead to security vulnerabilities if you accept Storable\ndocuments from untrusted sources with the default flags. Most obviously, the optional (off by\ndefault) CODE reference serialization feature allows transfer of code to the deserializing\nprocess. Furthermore, any serialized object will cause Storable to helpfully load the module\ncorresponding to the class of the object in the deserializing module. For manipulated module\nnames, this can load almost arbitrary code. Finally, the deserialized object's destructors\nwill be invoked when the objects get destroyed in the deserializing process. Maliciously\ncrafted Storable documents may put such objects in the value of a hash key that is overridden\nby another key/value pair in the same hash, thus causing immediate destructor execution.\n\nTo disable blessing objects while thawing/retrieving remove the flag \"BLESSOK\" = 2 from\n$Storable::flags or set the 2nd argument for thaw/retrieve to 0.\n\nTo disable tieing data while thawing/retrieving remove the flag \"TIEOK\" = 4 from\n$Storable::flags or set the 2nd argument for thaw/retrieve to 0.\n\nWith the default setting of $Storable::flags = 6, creating or destroying random objects, even\nrenamed objects can be controlled by an attacker. See CVE-2015-1592 and its metasploit\nmodule.\n\nIf your application requires accepting data from untrusted sources, you are best off with a\nless powerful and more-likely safe serialization format and implementation. If your data is\nsufficiently simple, Cpanel::JSON::XS, Data::MessagePack or Sereal are the best choices and\noffer maximum interoperability, but note that Sereal is unsafe by default.\n" } ] }, "WARNING": { "content": "If you're using references as keys within your hash tables, you're bound to be disappointed\nwhen retrieving your data. Indeed, Perl stringifies references used as hash table keys. If\nyou later wish to access the items via another reference stringification (i.e. using the same\nreference that was used for the key originally to record the value into the hash table), it\nwill work because both references stringify to the same string.\n\nIt won't work across a sequence of \"store\" and \"retrieve\" operations, however, because the\naddresses in the retrieved objects, which are part of the stringified references, will\nprobably differ from the original addresses. The topology of your structure is preserved, but\nnot hidden semantics like those.\n\nOn platforms where it matters, be sure to call \"binmode()\" on the descriptors that you pass\nto Storable functions.\n\nStoring data canonically that contains large hashes can be significantly slower than storing\nthe same data normally, as temporary arrays to hold the keys for each hash have to be\nallocated, populated, sorted and freed. Some tests have shown a halving of the speed of\nstoring -- the exact penalty will depend on the complexity of your data. There is no\nslowdown on retrieval.\n", "subsections": [] }, "REGULAR EXPRESSIONS": { "content": "Storable now has experimental support for storing regular expressions, but there are\nsignificant limitations:\n\n• perl 5.8 or later is required.\n\n• regular expressions with code blocks, ie \"/(?{ ... })/\" or \"/(??{ ... })/\" will throw an\nexception when thawed.\n\n• regular expression syntax and flags have changed over the history of perl, so a regular\nexpression that you freeze in one version of perl may fail to thaw or behave differently\nin another version of perl.\n\n• depending on the version of perl, regular expressions can change in behaviour depending\non the context, but later perls will bake that behaviour into the regexp.\n\nStorable will throw an exception if a frozen regular expression cannot be thawed.\n", "subsections": [] }, "BUGS": { "content": "You can't store GLOB, FORMLINE, etc.... If you can define semantics for those operations,\nfeel free to enhance Storable so that it can deal with them.\n\nThe store functions will \"croak\" if they run into such references unless you set\n$Storable::forgiveme to some \"TRUE\" value. In that case, the fatal message is converted to a\nwarning and some meaningless string is stored instead.\n\nSetting $Storable::canonical may not yield frozen strings that compare equal due to possible\nstringification of numbers. When the string version of a scalar exists, it is the form\nstored; therefore, if you happen to use your numbers as strings between two freezing\noperations on the same data structures, you will get different results.\n\nWhen storing doubles in network order, their value is stored as text. However, you should\nalso not expect non-numeric floating-point values such as infinity and \"not a number\" to pass\nsuccessfully through a nstore()/retrieve() pair.\n\nAs Storable neither knows nor cares about character sets (although it does know that\ncharacters may be more than eight bits wide), any difference in the interpretation of\ncharacter codes between a host and a target system is your problem. In particular, if host\nand target use different code points to represent the characters used in the text\nrepresentation of floating-point numbers, you will not be able be able to exchange floating-\npoint data, even with nstore().\n\n\"Storable::droputf8\" is a blunt tool. There is no facility either to return all strings as\nutf8 sequences, or to attempt to convert utf8 data back to 8 bit and \"croak()\" if the\nconversion fails.\n\nPrior to Storable 2.01, no distinction was made between signed and unsigned integers on\nstoring. By default Storable prefers to store a scalars string representation (if it has\none) so this would only cause problems when storing large unsigned integers that had never\nbeen converted to string or floating point. In other words values that had been generated by\ninteger operations such as logic ops and then not used in any string or arithmetic context\nbefore storing.\n", "subsections": [ { "name": "64 bit data in perl 5.6.0 and 5.6.1", "content": "This section only applies to you if you have existing data written out by Storable 2.02 or\nearlier on perl 5.6.0 or 5.6.1 on Unix or Linux which has been configured with 64 bit integer\nsupport (not the default) If you got a precompiled perl, rather than running Configure to\nbuild your own perl from source, then it almost certainly does not affect you, and you can\nstop reading now (unless you're curious). If you're using perl on Windows it does not affect\nyou.\n\nStorable writes a file header which contains the sizes of various C language types for the C\ncompiler that built Storable (when not writing in network order), and will refuse to load\nfiles written by a Storable not on the same (or compatible) architecture. This check and a\ncheck on machine byteorder is needed because the size of various fields in the file are given\nby the sizes of the C language types, and so files written on different architectures are\nincompatible. This is done for increased speed. (When writing in network order, all fields\nare written out as standard lengths, which allows full interworking, but takes longer to read\nand write)\n\nPerl 5.6.x introduced the ability to optional configure the perl interpreter to use C's \"long\nlong\" type to allow scalars to store 64 bit integers on 32 bit systems. However, due to the\nway the Perl configuration system generated the C configuration files on non-Windows\nplatforms, and the way Storable generates its header, nothing in the Storable file header\nreflected whether the perl writing was using 32 or 64 bit integers, despite the fact that\nStorable was storing some data differently in the file. Hence Storable running on perl with\n64 bit integers will read the header from a file written by a 32 bit perl, not realise that\nthe data is actually in a subtly incompatible format, and then go horribly wrong (possibly\ncrashing) if it encountered a stored integer. This is a design failure.\n\nStorable has now been changed to write out and read in a file header with information about\nthe size of integers. It's impossible to detect whether an old file being read in was\nwritten with 32 or 64 bit integers (they have the same header) so it's impossible to\nautomatically switch to a correct backwards compatibility mode. Hence this Storable defaults\nto the new, correct behaviour.\n\nWhat this means is that if you have data written by Storable 1.x running on perl 5.6.0 or\n5.6.1 configured with 64 bit integers on Unix or Linux then by default this Storable will\nrefuse to read it, giving the error Byte order is not compatible. If you have such data then\nyou should set $Storable::interwork5664bit to a true value to make this Storable read and\nwrite files with the old header. You should also migrate your data, or any older perl you\nare communicating with, to this current version of Storable.\n\nIf you don't have data written with specific configuration of perl described above, then you\ndo not and should not do anything. Don't set the flag - not only will Storable on an\nidentically configured perl refuse to load them, but Storable a differently configured perl\nwill load them believing them to be correct for it, and then may well fail or crash part way\nthrough reading them.\n" } ] }, "CREDITS": { "content": "Thank you to (in chronological order):\n\nJarkko Hietaniemi \nUlrich Pfeifer \nBenjamin A. Holzman \nAndrew Ford \nGisle Aas \nJeff Gresham \nMurray Nesbitt \nMarc Lehmann \nJustin Banks \nJarkko Hietaniemi (AGAIN, as perl 5.7.0 Pumpkin!)\nSalvador Ortiz Garcia \nDominic Dunlop \nErik Haugan \nBenjamin A. Holzman \nReini Urban \nTodd Rinaldo \nAaron Crane \n\nfor their bug reports, suggestions and contributions.\n\nBenjamin Holzman contributed the tied variable support, Andrew Ford contributed the canonical\norder for hashes, and Gisle Aas fixed a few misunderstandings of mine regarding the perl\ninternals, and optimized the emission of \"tags\" in the output streams by simply counting the\nobjects instead of tagging them (leading to a binary incompatibility for the Storable image\nstarting at version 0.6--older images are, of course, still properly understood). Murray\nNesbitt made Storable thread-safe. Marc Lehmann added overloading and references to tied\nitems support. Benjamin Holzman added a performance improvement for overloaded classes;\nthanks to Grant Street Group for footing the bill. Reini Urban took over maintenance from\np5p, and added security fixes and huge object support.\n", "subsections": [] }, "AUTHOR": { "content": "Storable was written by Raphael Manfredi Maintenance is now done\nby cperl \n\nPlease e-mail us with problems, bug fixes, comments and complaints, although if you have\ncompliments you should send them to Raphael. Please don't e-mail Raphael with problems, as\nhe no longer works on Storable, and your message will be delayed while he forwards it to us.\n", "subsections": [] }, "SEE ALSO": { "content": "Clone.\n\n\n\nperl v5.34.0 2026-06-23 Storable(3perl)", "subsections": [] } } } }