Title: inspect.getattr_static code execution with meta-metaclasses
Type: behavior Stage: resolved
Components: Library (Lib) Versions: Python 3.2, Python 3.3
Status: closed Resolution: fixed
Dependencies: Superseder:
Assigned To: michael.foord Nosy List: Trundle, michael.foord, ncoghlan, python-dev
Priority: normal Keywords: patch

Created on 2011-04-11 22:46 by Trundle, last changed 2011-12-22 01:13 by python-dev. This issue is now closed.

File name Uploaded Description Edit
getattr_static_metaclasses.patch Trundle, 2011-04-11 22:46 review
getattr_static_metaclasses_v2.patch Trundle, 2011-12-21 21:44 review
Messages (4)
msg133549 - (view) Author: Andreas Stührk (Trundle) * Date: 2011-04-11 22:46
The commit for issue #11133 omitted a part of the patch that checked whether the __dict__ attribute of metaclasses are shadowed. That makes it possible to trigger code execution in the case of metaclasses that have metaclasses.

Attached is a patch with a test and a fix.
msg149810 - (view) Author: Michael Foord (michael.foord) * (Python committer) Date: 2011-12-19 01:28
Andreas, is this still needed and valid?
msg150046 - (view) Author: Andreas Stührk (Trundle) * Date: 2011-12-21 21:44
As the test demonstrates, it's still possible to trigger a dynamic lookup without the patch, hence I think this is still needed and valid, yes.

I updated the patch to make it reflect the latest committed changes.
msg150060 - (view) Author: Roundup Robot (python-dev) (Python triager) Date: 2011-12-22 01:13
New changeset 8f33758df19a by Michael Foord in branch '3.2':
Metaclasses with metaclasses with a __dict__ descriptor can no longer trigger code execution with inspect.getattr_static.
Date User Action Args
2011-12-22 01:13:43python-devsetstatus: open -> closed

nosy: + python-dev
messages: + msg150060

resolution: fixed
stage: patch review -> resolved
2011-12-21 21:44:08Trundlesetfiles: + getattr_static_metaclasses_v2.patch

messages: + msg150046
2011-12-19 01:28:19michael.foordsetassignee: michael.foord
messages: + msg149810
2011-07-15 18:54:52pitrousetnosy: + ncoghlan

stage: patch review
2011-04-11 22:46:41Trundlecreate