cpython: 8f33758df19a (original) (raw)

Mercurial > cpython

changeset 74122:8f33758df19a 3.2

Metaclasses with metaclasses with a __dict__ descriptor can no longer trigger code execution with inspect.getattr_static. Closes issue 11829. [#11829]

Michael Foord michael@voidspace.org.uk
date	Thu, 22 Dec 2011 01:13:37 +0000
parents	82557279efd2
children	282a2a245278 dc913f73a7fb
files	Lib/inspect.py Lib/test/test_inspect.py Misc/NEWS
diffstat	3 files changed, 25 insertions(+), 4 deletions(-)[+] [-] Lib/inspect.py 9 Lib/test/test_inspect.py 17 Misc/NEWS 3

line wrap: on

line diff

--- a/Lib/inspect.py +++ b/Lib/inspect.py @@ -1161,10 +1161,11 @@ def getattr_static(obj, attr, default=_s if obj is klass: # for types we check the metaclass too for entry in _static_getmro(type(klass)):

```
       try:[](#l1.7)
```

           return entry.__dict__[attr][](#l1.8)

```
       except KeyError:[](#l1.9)
```
```
           pass[](#l1.10)
```

       if _shadowed_dict(type(entry)) is _sentinel:[](#l1.11)

```
           try:[](#l1.12)
```

               return entry.__dict__[attr][](#l1.13)

```
           except KeyError:[](#l1.14)
```
```
               pass[](#l1.15)
```
if default is not _sentinel: return default raise AttributeError(attr)

--- a/Lib/test/test_inspect.py +++ b/Lib/test/test_inspect.py @@ -1088,6 +1088,23 @@ class TestGetattrStatic(unittest.TestCas self.assertIsNot(inspect.getattr_static(sys, "version", sentinel), sentinel)

def test_metaclass_with_metaclass_with_dict_as_property(self):
```
   class MetaMeta(type):[](#l2.8)
```
```
       @property[](#l2.9)
```
```
       def __dict__(self):[](#l2.10)
```

           self.executed = True[](#l2.11)

           return dict(spam=42)[](#l2.12)

   class Meta(type, metaclass=MetaMeta):[](#l2.14)

```
       executed = False[](#l2.15)
```

   class Thing(metaclass=Meta):[](#l2.17)

```
       pass[](#l2.18)
```

   with self.assertRaises(AttributeError):[](#l2.20)

       inspect.getattr_static(Thing, "spam")[](#l2.21)

   self.assertFalse(Thing.executed)[](#l2.22)

+ class TestGetGeneratorState(unittest.TestCase): def setUp(self):

--- a/Misc/NEWS +++ b/Misc/NEWS @@ -97,6 +97,9 @@ Core and Builtins Library ------- +- Issue #11829: Fix code execution holes in inspect.getattr_static for

metaclasses with metaclasses. Patch by Andreas Stührk. +

Issue #1785: Fix inspect and pydoc with misbehaving descriptors.
Issue #11813: Fix inspect.getattr_static for modules. Patch by Andreas