WIP: Add datetime, decimal and re to allowed modules list for safe_repr

ionelmc / python-hunter

Hunter is a flexible code tracing toolkit.

https://python-hunter.readthedocs.io/

BSD 2-Clause "Simplified" License

794 stars 46 forks source link

WIP: Add datetime, decimal and re to allowed modules list for safe_repr #84

Closed GertBurger closed 3 years ago

GertBurger commented 4 years ago

RE Issue #83

Thought I'd create this as a PoC initially before taking it any further, comments are welcome.

I had a look through the source code of these modules:

datetime seems pretty safe but there is a chance that a rogue tzinfo implementation can do weird things. The builtin ones are fine, as well as timezones created by pytz.
decimal: checked both _decimal and _pydecimal. looks clear.
re: also looks clear but its quite tricky to confirm, there are a lot of modules at play.

ionelmc commented 4 years ago

Basically anything that uses isinstance, issubclass or even any dunder method/attribute like __class__ is unsafe. Yes, tzinfo needs to be handled specifically to not use any __repr__.

ionelmc commented 3 years ago

@GertBurger still want to work on this?

GertBurger commented 3 years ago

Hey,

Not particularly. I ended up using my branch in the PR for a few things and I didn't run into any issues but I am sure there are edge cases that it can't handle properly.

I'm not sure what should be done. repr_func='repr' seems like a easy workaround now so maybe the only chance required is some documentation ;P

You can close/delete my PR/ticket if they are not required anymore.

Cheers

On Tue, 18 Aug 2020 at 09:31, Ionel Cristian Mărieș < notifications@github.com> wrote:

@GertBurger still want to work on this?

— You are receiving this because you were mentioned. Reply to this email directly, view it on GitHub, or unsubscribe.

ionelmc commented 3 years ago

Fixed now, you might want to switch to the upcoming 3.2.1, cause 3.2 has some perf improvements.