Apply the same async and zodbpickle fixes to the ZEO4 server.

src/ZEO/tests/ZEO4/zrpc/connection.py

@@ -418,10 +418,10 @@ def message_input(self, message):
         # will raise an exception.  The exception will ultimately
         # result in asycnore calling handle_error(), which will
         # close the connection.
-        msgid, async, name, args = self.decode(message)
+        msgid, async_, name, args = self.decode(message)
 
         if debug_zrpc:
-            self.log("recv msg: %s, %s, %s, %s" % (msgid, async, name,
+            self.log("recv msg: %s, %s, %s, %s" % (msgid, async_, name,
                                                    short_repr(args)),
                      level=TRACE)
 
@@ -446,12 +446,12 @@ def message_input(self, message):
                     self.send_reply(msgid, ret)
 
         elif name == REPLY:
-            assert not async
+            assert not async_
             self.handle_reply(msgid, args)
         else:
-            self.handle_request(msgid, async, name, args)
+            self.handle_request(msgid, async_, name, args)
 
-    def handle_request(self, msgid, async, name, args):
+    def handle_request(self, msgid, async_, name, args):
         obj = self.obj
 
         if name.startswith('_') or not hasattr(obj, name):
@@ -482,14 +482,14 @@ def handle_request(self, msgid, async, name, args):
                 self.log("%s() raised exception: %s" % (name, msg),
                          logging.ERROR, exc_info=True)
             error = sys.exc_info()[:2]
-            if async:
+            if async_:
                 self.log("Asynchronous call raised exception: %s" % self,
                          level=logging.ERROR, exc_info=True)
             else:
                 self.return_error(msgid, *error)
             return
 
-        if async:
+        if async_:
             if ret is not None:
                 raise ZRPCError("async method %s returned value %s" %
                                 (name, short_repr(ret)))
@@ -545,15 +545,15 @@ def setSessionKey(self, key):
 
     def send_call(self, method, args, async_=False):
         # send a message and return its msgid
-        if async:
+        if async_:
             msgid = 0
         else:
             msgid = self._new_msgid()
 
         if debug_zrpc:
-            self.log("send msg: %d, %d, %s, ..." % (msgid, async, method),
+            self.log("send msg: %d, %d, %s, ..." % (msgid, async_, method),
                      level=TRACE)
-        buf = self.encode(msgid, async, method, args)
+        buf = self.encode(msgid, async_, method, args)
         self.message_output(buf)
         return msgid
 

src/ZEO/tests/ZEO4/zrpc/marshal.py

@@ -17,6 +17,8 @@
 from .error import ZRPCError
 from .log import log, short_repr
 
+PY2 = not PY3
+
 def encode(*args): # args: (msgid, flags, name, args)
     # (We used to have a global pickler, but that's not thread-safe. :-( )
 
@@ -106,6 +108,8 @@ def server_decode(msg):
 
 exception_type_type = type(Exception)
 
+_SAFE_MODULE_NAMES = ('ZopeUndo.Prefix', 'copy_reg', '__builtin__', 'zodbpickle')
+
 def find_global(module, name):
     """Helper for message unpickler"""
     try:
@@ -118,7 +122,7 @@ def find_global(module, name):
     except AttributeError:
         raise ZRPCError("module %s has no global %s" % (module, name))
 
-    safe = getattr(r, '__no_side_effects__', 0)
+    safe = getattr(r, '__no_side_effects__', 0) or (PY2 and module in _SAFE_MODULE_NAMES)
     if safe:
         return r
 
@@ -130,9 +134,10 @@ def find_global(module, name):
 
 def server_find_global(module, name):
     """Helper for message unpickler"""
+    if module not in _SAFE_MODULE_NAMES:
+        raise ImportError("Module not allowed: %s" % (module,))
+
     try:
-        if module != 'ZopeUndo.Prefix':
-            raise ImportError
         m = __import__(module, _globals, _globals, _silly)
     except ImportError as msg:
         raise ZRPCError("import error %s: %s" % (module, msg))