Re: [Python-Dev] Set the namespace free!
On 7/22/2010 5:45 AM, python-dev-request@python.org wrote:
Message: 10 Date: Thu, 22 Jul 2010 16:04:00 +0200 From: Bartosz Tarnowski<bartosz-tarnowski@zlotniki.pl> To:python-dev@python.org Subject: [Python-Dev] Set the namespace free! Message-ID:<4C484FD0.2080803@zlotniki.pl> Content-Type: text/plain; charset=UTF-8; format=flowed
Hello, guys.
Python has more and more reserved words over time. It becomes quite annoying, since you can not use variables and attributes of such names. Suppose I want to make an XML parser that reads a document and returns an object with attributes corresponding to XML element attributes:
elem = parse_xml("<element param='boo'/>") print elem.param
What should I do then, when the attribute is a reserver word?
That's a misuse of attributes. When you need objects with unconstrained fields, inherit them from "dict", and write print(elem['param']) This protects you not only from name clashes, but from difficulties with names that don't fit Python attribute syntax. (BeautifulSoup occasionally crashes due to this problem when parsing malformed HTML). You can still provide a "__getattr__" function, if desired, for convenient access to commonly used attributes. Using "setattr" to set attributes, where the attribute string comes from an external source, can create a security hole. Remember that you can override functions on an object, for that object only, by setting an attribute. This offers the opportunity for an attack similar to SQL injection. Think about what this can do to a parser that has and calls a method "display" for each element: <element display='lambda x : subprocess.Popen("rm -r -f /")'> You are pwned. John Nagle
Using "setattr" to set attributes, where the attribute string comes from an external source, can create a security hole. Remember that you can override functions on an object, for that object only, by setting an attribute. This offers the opportunity for an attack similar to SQL injection. Think about what this can do to a parser that has and calls a method "display" for each element:
<element display='lambda x : subprocess.Popen("rm -r -f /")'>
You are pwned.
Nope. You’d have to give setattr a function object, not a string. Regards
Using "setattr" to set attributes, where the attribute string comes from an external source, can create a security hole. Remember that you can override functions on an object, for that object only, by setting an attribute. This offers the opportunity for an attack similar to SQL injection. Think about what this can do to a parser that has and calls a method "display" for each element:
<element display='lambda x : subprocess.Popen("rm -r -f /")'>
You are pwned.
Nope. You’d have to give setattr a function object, not a string. Regards
On 7/22/2010 2:04 PM, John Nagle wrote:
From: Bartosz Tarnowski<bartosz-tarnowski@zlotniki.pl>
Python has more and more reserved words over time ... What should I do then, when the attribute is a reserver word?
I am going to be a grinch and note that this is strictly a usage question with no development implications. It therefore is off topic here and should have been asked and answered on python-list or the mirrored newsgroup.
That's a misuse of attributes. When you need objects with unconstrained fields, inherit them from "dict", and write
print(elem['param'])
Right ;-) -- Terry Jan Reedy
participants (4)
-
John Nagle -
Terry Reedy -
Éric Araujo -
Éric Araujo