Repository: Pylons/pyramid

Issue:
Feature Request- deprecate/remove PickleSerializer
This has basically already been decided to happen, but the timing is not clear.  I could not find the scheduled removal listed anywhere.

`[pyramid.session.PickleSerializer](https://github.com/Pylons/pyramid/blob/587fe72fae0efda3a860d37a1ea2449a41dab622/src/pyramid/session.py#L46-L70)` is the legacy session implementation and [not used by any actual code in Pyramid](https://github.com/Pylons/pyramid/search?q=PickleSerializer&unscoped_q=PickleSerializer).

It only exists in a test, docs and the changelog.  The code is simple enough that it could be consolidated into the narrative docs that invoke it.

If this is staying for a while to enable 3rd party libraries that require it, I suggest invoking a `warnings.warn`  on `PickleSerializer.__init__()` to have people upgrade.

If this does not need to stay, can it be removed sooner than later?   I keep nearly using it on a compatibility layer, and then I realize this will likely be gone soon.



Discussion:
Did you see this?

https://docs.pylonsproject.org/projects/pyramid/en/latest/narr/sessions.html#upcoming-changes-to-isession-in-pyramid-2-0
Yes.  The current source reflects those changes. This serializer class is only used in a test and is referenced by those docs (I actually linked to their source above).  That's why I think it could be removed is and those docs just incorporate the pickle loads.



> On Sep 19, 2019, at 7:26 PM, Steve Piercy <notifications@github.com> wrote:
> 
> Did you see this?
> 
> https://docs.pylonsproject.org/projects/pyramid/en/latest/narr/sessions.html#upcoming-changes-to-isession-in-pyramid-2-0
> 
> —
> You are receiving this because you authored the thread.
> Reply to this email directly, view it on GitHub, or mute the thread.

I'd accept a PR to remove it.

I'd like to ship a 1.10 version with a few more things deprecated including pyramid.compat.
@mmerickel I am happy to generate a PR for this.  should it be against `master`, `1.10-branch` or something else?
Please make changes to `master`. Optionally cherry-pick the same changes, if possible, to `1.10-branch` in a separate PR.
My suggestion is to just deprecate it in master and we'll remove it in a future release.

Resolving patch:
diff --git a/src/pyramid/session.py b/src/pyramid/session.py
--- a/src/pyramid/session.py
+++ b/src/pyramid/session.py
@@ -44,14 +44,25 @@ def changed(session, *arg, **kw):
 
 
 class PickleSerializer(object):
-    """ A serializer that uses the pickle protocol to dump Python
-    data to bytes.
+    """
+    .. deprecated:: 2.0
+
+    .. warning::
+
+        In :app:`Pyramid` 2.0 the default ``serializer`` option changed to
+        use :class:`pyramid.session.JSONSerializer`, and ``PickleSerializer``
+        has been been removed from active Pyramid code.
+
+        Pyramid will require JSON-serializable objects in :app:`Pyramid` 2.0.
+
+        Please see :ref:`pickle_session_deprecation`.
 
-    This is the default serializer used by Pyramid.
+    A serializer that uses the pickle protocol to dump Python data to bytes.
+
+    This was the default serializer used by Pyramid, but has been deprecated.
 
     ``protocol`` may be specified to control the version of pickle used.
     Defaults to :attr:`pickle.HIGHEST_PROTOCOL`.
-
     """
 
     def __init__(self, protocol=pickle.HIGHEST_PROTOCOL):
@@ -61,8 +72,9 @@ def loads(self, bstruct):
         """Accept bytes and return a Python object."""
         try:
             return pickle.loads(bstruct)
-        # at least ValueError, AttributeError, ImportError but more to be safe
         except Exception:
+            # this block should catch at least:
+            # ValueError, AttributeError, ImportError; but more to be safe
             raise ValueError
 
     def dumps(self, appstruct):
@@ -70,6 +82,14 @@ def dumps(self, appstruct):
         return pickle.dumps(appstruct, self.protocol)
 
 
+deprecated(
+    'PickleSerializer',
+    'pyramid.session.PickleSerializer is deprecated as of Pyramid 2.0 for '
+    'security concerns. Use pyramid.session.JSONSerializer or reference the '
+    'narrative documentation for information on building a migration tool.',
+)
+
+
 JSONSerializer = JSONSerializer  # api
 
 
@@ -438,10 +458,10 @@ def SignedCookieSessionFactory(
 
     .. warning::
 
-       In :app:`Pyramid` 2.0 the default ``serializer`` option changed to
-       use :class:`pyramid.session.JSONSerializer`. See
-       :ref:`pickle_session_deprecation` for more information about why this
-       change was made.
+        In :app:`Pyramid` 2.0 the default ``serializer`` option changed to
+        use :class:`pyramid.session.JSONSerializer`. See
+        :ref:`pickle_session_deprecation` for more information about why this
+        change was made.
 
     .. versionadded: 1.5a3
 


Test patch:
diff --git a/tests/test_session.py b/tests/test_session.py
--- a/tests/test_session.py
+++ b/tests/test_session.py
@@ -564,6 +564,10 @@ def test_it(self):
 
 
 class TestPickleSerializer(unittest.TestCase):
+    """
+    .. deprecated:: 2.0
+    """
+
     def _makeOne(self):
         from pyramid.session import PickleSerializer