Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Resolve variable masking issue in ui.browseableMessage #16380

Merged
merged 1 commit into from Apr 11, 2024

Conversation

CyrilleB79
Copy link
Collaborator

Link to issue number:

Fix-up of PR from GHSA-xg6w-23rw-39r8.

Summary of the issue:

A masking issue was found in ui.browseableMessage where we try to call the module level function message but it is masked by the local variable message which is an argument of ui.browseableMessage.

Description of user facing changes

In case an installation cannot create a Scripting.Dictionary COM object, a message will now be reported.

Description of development approach

I access the module level message function through globals() dictionary and store it in a new local variable to use it.
It would have been cleaner to rename the argument of ui.browseableMessage but I have not done so because changing the signature of a function is API-breaking.

I have also caught one more exception type because I have realized while testing that calling comtypes.client.CreateObject with an unknown class string raises OSError.

Testing strategy:

Manual test: modify the class string to force the exception. E.g. call:
comtypes.client.CreateObject('Scripting.TestUnexistingClass')

Known issues with pull request:

None

Change log

Not needed: I guess no one has ever fallen in this code path.

Note

I have found this issue while doing tests.
But fortunately, I have not found any plateform where Scripting.Dictionary cannot be created.

Code Review Checklist:

  • Documentation:
    • Change log entry
    • User Documentation
    • Developer / Technical Documentation
    • Context sensitive help for GUI changes
  • Testing:
    • Unit tests
    • System (end to end) tests
    • Manual testing
  • UX of all users considered:
    • Speech
    • Braille
    • Low Vision
    • Different web browsers
    • Localization in other languages / culture than English
  • API is compatible with existing add-ons.
  • Security precautions taken.

@CyrilleB79 CyrilleB79 marked this pull request as ready for review April 10, 2024 14:42
@CyrilleB79 CyrilleB79 requested a review from a team as a code owner April 10, 2024 14:42
@seanbudd seanbudd merged commit 20342a3 into nvaccess:master Apr 11, 2024
1 check passed
@nvaccessAuto nvaccessAuto added this to the 2024.2 milestone Apr 11, 2024
@CyrilleB79 CyrilleB79 deleted the msgFct branch April 11, 2024 06:41
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

None yet

3 participants