inspect.getattr_static code execution with meta-metaclasses

[Trundle]

BPO	11829
Nosy	@ncoghlan, @voidspace, @Trundle
Files	getattr_static_metaclasses.patch getattr_static_metaclasses_v2.patch

^{Note: these values reflect the state of the issue at the time it was migrated and might not reflect the current state.}

Show more details

GitHub fields:

assignee = 'https://github.com/voidspace'
closed_at = <Date 2011-12-22.01:13:43.446>
created_at = <Date 2011-04-11.22:46:41.295>
labels = ['type-bug', 'library']
title = 'inspect.getattr_static code execution with meta-metaclasses'
updated_at = <Date 2011-12-22.01:13:43.444>
user = 'https://github.com/Trundle'

bugs.python.org fields:

activity = <Date 2011-12-22.01:13:43.444>
actor = 'python-dev'
assignee = 'michael.foord'
closed = True
closed_date = <Date 2011-12-22.01:13:43.446>
closer = 'python-dev'
components = ['Library (Lib)']
creation = <Date 2011-04-11.22:46:41.295>
creator = 'Trundle'
dependencies = []
files = ['21621', '24073']
hgrepos = []
issue_num = 11829
keywords = ['patch']
message_count = 4.0
messages = ['133549', '149810', '150046', '150060']
nosy_count = 4.0
nosy_names = ['ncoghlan', 'michael.foord', 'Trundle', 'python-dev']
pr_nums = []
priority = 'normal'
resolution = 'fixed'
stage = 'resolved'
status = 'closed'
superseder = None
type = 'behavior'
url = 'https://bugs.python.org/issue11829'
versions = ['Python 3.2', 'Python 3.3']

[Trundle]

The commit for issue bpo-11133 omitted a part of the patch that checked whether the __dict__ attribute of metaclasses are shadowed. That makes it possible to trigger code execution in the case of metaclasses that have metaclasses.

Attached is a patch with a test and a fix.

[voidspace]

Andreas, is this still needed and valid?

[Trundle]

As the test demonstrates, it's still possible to trigger a dynamic lookup without the patch, hence I think this is still needed and valid, yes.

I updated the patch to make it reflect the latest committed changes.

[python-dev]

New changeset 8f33758df19a by Michael Foord in branch '3.2':
Metaclasses with metaclasses with a __dict__ descriptor can no longer trigger code execution with inspect.getattr_static.
http://hg.python.org/cpython/rev/8f33758df19a