classification
Title: inspect.getattr_static code execution w/ class body as non dict
Type: Stage: test needed
Components: Library (Lib) Versions: Python 3.3, Python 3.2
process
Status: closed Resolution: invalid
Dependencies: Superseder:
Assigned To: michael.foord Nosy List: Trundle, daniel.urban, eric.araujo, michael.foord, ysj.ray
Priority: normal Keywords:

Created on 2011-04-04 20:35 by michael.foord, last changed 2011-12-19 01:27 by michael.foord. This issue is now closed.

Messages (4)
msg132967 - (view) Author: Michael Foord (michael.foord) * (Python committer) Date: 2011-04-04 20:35
In Python 3 a metclass can create a class __dict__ that is not a true dictionary. This can trigger code execution when accessing __dict__ members. getattr_static should not access them directly but do so using dict methods directly for dict subclasses and skipping classes that have non-dicts for __dict__.

The documentation should mention explicitly that the "no code execution" feature of this function is *not* a security feature and should not be relied on for security purposes.
msg133286 - (view) Author: Andreas Stührk (Trundle) Date: 2011-04-08 01:48
Can you perhaps elaborate on the first part? I really can't see right now how a class __dict__ can be something different from a dictionary. It's true that the class dict can be any mapping while the class is being created, but that's uninteresting for getattr_static as there is no class object yet that one can pass to getattr_static.
msg133321 - (view) Author: Éric Araujo (eric.araujo) * (Python committer) Date: 2011-04-08 15:51
Andreas:  metaclass.__prepare__ can return any mapping object.  See http://docs.python.org/dev/reference/datamodel#customizing-class-creation
msg133323 - (view) Author: Éric Araujo (eric.araujo) * (Python committer) Date: 2011-04-08 15:55
I shot too fast, you were right.  The mapping returned by __prepare__ is used during class creation, but __dict__ on the instance is a basic dict afterwards (not sure the doc is clear, I tested it in a shell).
History
Date User Action Args
2011-12-19 01:27:07michael.foordsetstatus: open -> closed
resolution: invalid
2011-04-08 16:05:18daniel.urbansetnosy: + daniel.urban
2011-04-08 15:55:12eric.araujosetmessages: + msg133323
2011-04-08 15:51:02eric.araujosetnosy: + eric.araujo
messages: + msg133321
2011-04-08 01:48:45Trundlesetmessages: + msg133286
2011-04-08 00:18:05Trundlesetnosy: + Trundle
2011-04-05 08:16:28ysj.raysetnosy: + ysj.ray
2011-04-04 20:35:20michael.foordcreate