On 6/30/06, <b class="gmail_sendername">Greg Ewing</b> <<a href="mailto:greg.ewing@canterbury.ac.nz">greg.ewing@canterbury.ac.nz</a>> wrote:<div><span class="gmail_quote"></span><blockquote class="gmail_quote" style="border-left: 1px solid rgb(204, 204, 204); margin: 0pt 0pt 0pt 0.8ex; padding-left: 1ex;">
Brett Cannon wrote:<br><br>> 1) Is removing 'file' from the builtins dict in PyInterpreterState (and<br>> maybe some other things) going to be safe enough to sufficiently hide<br>> 'file' confidently (short of someone being stupid in their C extension
<br>> module and exposing 'file' directly)?<br>><br>> 2) Changing open() to return C-implemented delegate objects for files<br>> (and thus won't type check, but this is Python so I am not worried about<br>> that too much) and delegate socket objects for IP and URL addresses.
<br><br>My suggestion is to change things so that the constructor<br>of the file type doesn't open files (at least in restricted<br>mode). Then it wouldn't matter if untrusted code had real<br>file objects, as they couldn't use them to get access to
<br>any other files.</blockquote><div><br>So require use of open() to open a file and then put the access restrictions in open() while turning off the constructor for file?<br><br>Seems reasonable. It basically shifts the access restrictions to open() instead of 'file'. For some reason this proposal makes me want to remove the checks in read/write methods as well. That way there is only open() that needs to do the checks and 'file' can have the constructor crippled and that be it. Really minimize the impact of code on 'file' itself.
<br><br>Do people think that having the restriction checks for every read/write method is necessary? I originally thought of doing that so that if an open file object leaked into a restricted interpreter by accident there would still be proper protections, but perhaps that should not be the resopnsibility of 'file' and instead should be more up to modules not passing back exposed 'file' objects into code.
<br><br>-Brett<br></div></div>