new

Currently, the following options are recognized, none of them are on by default.

refuse_snappy

If set, the decoder will refuse Snappy-compressed input data. This can be desirable for robustness. See the section "ROBUSTNESS" below.

refuse_objects

If set, the decoder will refuse deserializing any objects in the input stream and instead throw an exception. Defaults to off. See the section "ROBUSTNESS" below.

no_bless_objects

If set, the decoder will deserialize any objects in the input stream but without blessing them. Defaults to off. See the section "ROBUSTNESS" below.

validate_utf8

If set, the decoder will refuse invalid UTF-8 byte sequences. This is off by default, but it's strongly encouraged to be turned on if you're dealing with any data that has been encoded by an external source (e.g. http cookies).

max_recursion_depth

"Sereal::Decoder" is recursive. If you pass it a Sereal document that is deeply nested, it will eventually exhaust the C stack. Therefore, there is a limit on the depth of recursion that is accepted. It defaults to 10000 nested calls. You may choose to override this value with the "max_recursion_depth" option. Beware that setting it too high can cause hard crashes.

Do note that the setting is somewhat approximate. Setting it to 10000 may break at somewhere between 9997 and 10003 nested structures depending on their types.

max_num_hash_entries

If set to a non-zero value (default: 0), then "Sereal::Decoder" will refuse to deserialize any hash/dictionary (or hash-based object) with more than that number of entries. This is to be able to respond quickly to any future hash-collision attacks on Perl's hash function, and also the memory exhaustion attacks on Sereal itself. For a gentle introduction to the topic from the cryptographic point of view, see <http://en.wikipedia.org/wiki/Collision_attack>.

max_num_array_entries

If set to a non-zero value (default: 0), then "Sereal::Decoder" will refuse to deserialize any array with more than that number of entries. This is to be able to respond quickly to any future memory exhaustion attacks on Sereal.

max_string_length

If set to a non-zero value (default: 0), then "Sereal::Decoder" will refuse to deserialize any string with more than that number of characters. This is to be able to respond quickly to any future memory exhaustion attacks on Sereal.

max_uncompressed_size

If set to a non-zero value (default: 0), then "Sereal::Decoder" will refuse to deserialize any blob with a size that exceds the value when uncompressed. This is to be able to respond quickly to any future memory exhaustion attacks on Sereal.

incremental

If set to a non-zero value (default: 0), then "Sereal::Decoder" will destructively parse Sereal documents out of a variable. Every time a Sereal document is successfully parsed it is removed from the front of the string it is parsed from.

This means you can do this:

    while (length $buffer) {
        my $data= decode_sereal($buffer,{incremental=>1});
    }

alias_smallint

If set to a true value then "Sereal::Decoder" will share integers from -16 to 15 (encoded as either SRL_HDR_NEG and SRL_HDR_POS) as read-only aliases to a common SV.

The result of this may be significant space savings in data structures with many integers in the specified range. The cost is more memory used by the decoder and a very modest speed penalty when deserializing.

Note this option changes the structure of the dumped data. Use with caution.

See also the "alias_varint_under" option.

alias_varint_under

If set to a true positive integer smaller than 16 then this option is similar to setting "alias_smallint" and causes all integers from -16 to 15 to be shared as read-only aliases to the same SV, except that this treatment ALSO applies to SRL_HDR_VARINT. If set to a value larger than 16 then this applies to all varints varints under the value set. (In general SRL_HDR_VARINT is used only for integers larger than 15, and SRL_HDR_NEG and SRL_HDR_POS are used for -16 to -1 and 0 to 15 respectively.)

In simple terms if you want to share values larger than 16 then you should use this option, if you want to share only values in the -16 to 15 range then you should use the "alias_smallint" option instead.

The result of this may be significant space savings in data structures with many integers in the desire range. The cost is more memory used by the decoder and a very modest speed penalty when deserializing.

Note this option changes the structure of the dumped data. Use with caution.

use_undef

If set to a true value then this any undef value to be deserialized as PL_sv_undef. This may change the structure of the data structure being dumped, do not enable this unless you know what you are doing.

set_readonly

If set to a true value then the output will be completely readonly (deeply).

set_readonly_scalars

If set to a true value then scalars in the output will be readonly (deeply). References won't be readonly.

decode

The two are subtly different in case of data structures that contain references to the root element. In that case, the return value will be a (non-recursive) copy of the reference. The pass-in style is more correct. In other words,

  $decoder->decode($sereal_string, my $out);
  # is almost the same but safer than:
  my $out = $decoder->decode($sereal_string);

This is an unfortunate side-effect of perls standard copy semantics of assignment. Possibly one day we will have an alternative to this.

decode_with_header

It accepts an optional second parameter, which is a scalar to write the body to, and an optional third parameter, which is a scalar to write the header to.

Regardless of the number of parameters received, "decode_with_header" returns an ArrayRef containing the deserialized header, and the deserialized body, in this order.

See "decode" for the subtle difference between the one, two and three parameters versions.

If there is no header in a Sereal document, corresponding variable or return value will be set to undef.

decode_only_header

It accepts an optional second parameter, which is a scalar to write the header to.

Regardless of the number of parameters received, "decode_only_header" returns the resulting data structure.

See "decode" for the subtle difference between the one and two parameters versions.

If there is no header in a Sereal document, corresponding variable or return value will be set to undef.

decode_with_offset

decode_only_header_with_offset

decode_with_header_and_offset

bytes_consumed

  my $out = $decoder->decode($sereal_string);
  if (length($sereal_string) != $decoder->bytes_consumed) {
    die "Not all input data was consumed!";
  }

Chances are that if you do this, you're violating UNIX philosophy in "be strict in what you emit but lenient in what you accept".

You can also use this to deserialize a list of Sereal documents that is concatenated into the same string (code not very robust...):

  my @out;
  my $pos = 0;
  eval {
    while (1) {
      push @out, $decoder->decode_with_offset($sereal_string, $pos);
      $pos += $decoder->bytes_consumed;
      last if $pos >= length($sereal_string)
           or not $decoder->bytes_consumed;
    }
  };

As mentioned, only the bytes consumed from the body are considered. So the following example is correct, as only the header is deserialized:

  my $header = $decoder->decode_only_header($sereal_string);
  my $count = $decoder->bytes_consumed;
  # $count is 0

decode_from_file

    Sereal::Decoder->decode_from_file($file);
    $decoder->decode_from_file($file);

Read and decode the file specified. If called in list context and incremental mode is enabled then decodes all packets contained in the file and returns a list, otherwise decodes the first (or only) packet in the file. Accepts an optinal "target" variable as a second argument.

looks_like_sereal

The return of this method may be treated as a simple boolean but is in fact a more complex return. When the argument does not look anything like a Sereal document then the return is perl's FALSE, which has the property of being string equivalent to "" and numerically equivalent to 0. However when the argument appears to be a UTF-8 encoded protocol 3 Sereal document (by noticing that the \xF3 in the magic string has been replaced by \xC3\xB3) then it returns 0 (the number, which is string equivalent to "0"), and otherwise returns the protocol version of the document. This means you can write something like this:

    $type= Sereal::Decoder->looks_like_sereal($thing);
    if ($type eq '') {
        say "Not a Sereal document";
    } elsif ($type eq '0') {
        say "Possibly utf8 encoded Sereal document";
    } else {
        say "Sereal document version $type";
    }

For reference, Sereal's magic value is a four byte string which is either "=srl" for protocol version 1 and 2 or "=\xF3rl" for protocol version 3 and later. This function checks that the magic string corresponds with the reported version number, as well as other checks, which may be enhanced in the future.

Note that looks_like_sereal() may be called as a class or object method, and may also be called as a single argument function. See the related scalar_looks_like_sereal() for a version which may ONLY be called as a function, not as a method (and which is typically much faster).

sereal_decode_with_object

This functional interface is marginally faster than the OO interface since it avoids method resolution overhead and, on sufficiently modern Perl versions, can usually avoid subroutine call overhead. See Sereal::Performance for a discussion on how to tune Sereal for maximum performance if you need to.

sereal_decode_with_header_with_object

This functional interface is marginally faster than the OO interface since it avoids method resolution overhead and, on sufficiently modern Perl versions, can usually avoid subroutine call overhead. See Sereal::Performance for a discussion on how to tune Sereal for maximum performance if you need to.

sereal_decode_only_header_with_object

This functional interface is marginally faster than the OO interface since it avoids method resolution overhead and, on sufficiently modern Perl versions, can usually avoid subroutine call overhead. See Sereal::Performance for a discussion on how to tune Sereal for maximum performance if you need to.

sereal_decode_only_header_with_offset_with_object

This functional interface is marginally faster than the OO interface since it avoids method resolution overhead and, on sufficiently modern Perl versions, can usually avoid subroutine call overhead. See Sereal::Performance for a discussion on how to tune Sereal for maximum performance if you need to.

sereal_decode_with_header_and_offset_with_object

This functional interface is marginally faster than the OO interface since it avoids method resolution overhead and, on sufficiently modern Perl versions, can usually avoid subroutine call overhead. See Sereal::Performance for a discussion on how to tune Sereal for maximum performance if you need to.

sereal_decode_with_offset_with_object

This functional interface is marginally faster than the OO interface since it avoids method resolution overhead and, on sufficiently modern Perl versions, can usually avoid subroutine call overhead. See Sereal::Performance for a discussion on how to tune Sereal for maximum performance if you need to.

decode_sereal

This functional interface is significantly slower than the OO interface since it cannot reuse the decoder object.

decode_sereal_with_header_data

This functional interface is significantly slower than the OO interface since it cannot reuse the decoder object.

scalar_looks_like_sereal

Note that this version cannot be called as a method. It is normally executed as a custom opcode, as such errors about its usage may be caught at compile time, and it should be much faster than looks_like_sereal.