search

python / cpython

The Python programming language
https://www.python.org
Other
63.37k stars 30.33k forks source link

inspect.getattr_static code execution with meta-metaclasses #56038

Closed 1dc5b0b2-06bc-4659-a037-b8d0a778b1ac closed 12 years ago

1dc5b0b2-06bc-4659-a037-b8d0a778b1ac commented 13 years ago
BPO 11829
Nosy @ncoghlan, @voidspace, @Trundle
Files
  • getattr_static_metaclasses.patch
  • getattr_static_metaclasses_v2.patch
    		•

    Note: these values reflect the state of the issue at the time it was migrated and might not reflect the current state.

    Show more details

    GitHub fields: ```python assignee = 'https://github.com/voidspace' closed_at = created_at = labels = ['type-bug', 'library'] title = 'inspect.getattr_static code execution with meta-metaclasses' updated_at = user = 'https://github.com/Trundle' ``` bugs.python.org fields: ```python activity = actor = 'python-dev' assignee = 'michael.foord' closed = True closed_date = closer = 'python-dev' components = ['Library (Lib)'] creation = creator = 'Trundle' dependencies = [] files = ['21621', '24073'] hgrepos = [] issue_num = 11829 keywords = ['patch'] message_count = 4.0 messages = ['133549', '149810', '150046', '150060'] nosy_count = 4.0 nosy_names = ['ncoghlan', 'michael.foord', 'Trundle', 'python-dev'] pr_nums = [] priority = 'normal' resolution = 'fixed' stage = 'resolved' status = 'closed' superseder = None type = 'behavior' url = 'https://bugs.python.org/issue11829' versions = ['Python 3.2', 'Python 3.3'] ```

    1dc5b0b2-06bc-4659-a037-b8d0a778b1ac commented 13 years ago

    The commit for issue bpo-11133 omitted a part of the patch that checked whether the __dict__ attribute of metaclasses are shadowed. That makes it possible to trigger code execution in the case of metaclasses that have metaclasses.

    Attached is a patch with a test and a fix.

    voidspace commented 12 years ago

    Andreas, is this still needed and valid?

    1dc5b0b2-06bc-4659-a037-b8d0a778b1ac commented 12 years ago

    As the test demonstrates, it's still possible to trigger a dynamic lookup without the patch, hence I think this is still needed and valid, yes.

    I updated the patch to make it reflect the latest committed changes.

    1762cc99-3127-4a62-9baf-30c3d0f51ef7 commented 12 years ago

    New changeset 8f33758df19a by Michael Foord in branch '3.2': Metaclasses with metaclasses with a __dict__ descriptor can no longer trigger code execution with inspect.getattr_static. http://hg.python.org/cpython/rev/8f33758df19a