Store's JSON serialization breaks when keys aren't JSON compatible

[GNajeraAdv]

Hi!

I'm trying to write up a concise example for version 6.0.0 of "django-debug-toolbar", but I think the JSON serialization introduced in release version 6.0.0 may be incompatible with recording calls to the Django's cache(s).

The only guideline for using the cache is "key should be a str, and value can be any picklable Python object.", and I'm actively seeing this erroring out in my project.

For example, when the "django-debug-toolbar" saves the "cache" panel details, it attempts to serialize the data into a JSON string.

However, it is perfectly valid for the data to contain complex Python objects (such as a Python dictionary that uses a Python Class as one of its keys).

I assume using "pickle" instead of JSON would resolve this, but maybe I'm oversimplifying this

[tim-schilling]

This is a duplicate of #2171

Pickle isn't really a reasonable choice as it isn't secure when you can't trust the user input. Since this would pickle pretty much everything associated with the request, there's likely a path for it to be a security vulnerability. Though it'd be something obscure.

[GNajeraAdv]

Thanks @tim-schilling!

Totally understand about the security concerns. I was hoping there was a common design pattern to securely store and retrieve pickled objects, but let's table that for now.

This is different from #2171 (that fix doesn't resolve my error). In my case, I'm using MemoryStore and when it saves the panels, I get a HTTP 500 response (not just an extra log emitted from Python into stderr)

---

I can't get the tests running on the "django-debug-toolbar", but I believe if you run the code snippet in one of the tests, you'll see the error I'm seeing. Note that I'm testing with a dict with a Python class as the key.

MemoryStore.save_panel(1, 1, {str: "this-is-a-string"})

---

I'll continue to attempt to get a test to showcase this issue, but I'm hoping this example is clear.

[tim-schilling]

@GNajeraAdv Can you share your stacktrace and error? I understand you're trying to help me reproduce it, but I won't know if I'm reproducing the same thing without seeing what you're seeing.

[tim-schilling]

I believe we're going to have to make use of json.dumps(skipkeys=True) here. The work here for a Djangonaut is to:

1. Take another look at how the JSON encoding works and and confirm/correct my thinking
2. Create a PR to add that argument to serializefunction in store.py, with a test, SerializationTestCase.test_serialize_unexpected that confirms the fix.
3. [Optional] Add a note to the cache and template panels documentation about context arguments that aren't strings may not be included in the toolbar's data.