pickled object's __setstate__() ignores exceptions

[rpq__@…]

I find it odd that any exceptions (TypeError too) raised in a pickled object's __setstate__() are ignored.

[Aymeric Augustin]

I fail to see how this is a bug in Django. pickle, __setstate__ and TypeError are pure Python concepts.

Please provide more information if you were actually describing a bug in Django.

[rpq__@…]

hi,

pickle, setstate, and TypeError are python concepts, however, i have an app where *any* exception thrown in a pickled object's setstate() for use in request.session are silently caught/ignored by django. this should not be difficult to reproduce. i verified that this does not happen in "pure python"; uncaught exceptions raised in a pickled object's setstate() were being thrown as expected.

[Ramiro Morales]

Now we are talking. Tickets opened with a description of 109 characters (less than a Tweet) aren't useful at all for anyone.

[Tim Graham]

It's not clear to me how we would fix this. How or why would a pickled object's __setstate__ throw an exception? In django.contrib.sessions.backends.base.SessionBase.decode there's a try/except which catches all exceptions with the following comment: "ValueError, SuspiciousOperation, deserialization exceptions. If any of these happen, just return an empty dictionary (an empty session)."

[Claude Paroz]

Now that Django session serializer defaults to JSON (​https://docs.djangoproject.com/en/dev/topics/http/sessions/#session-serialization), I'm not sure we'll fix this. If anyone can come up with some code to fix this issue, feel free to reopen.