[Python-Dev] Re: Security capabilities in Python

[Ka-Ping Yee]

On Sat, 9 Apr 2005, Fredrik Lundh wrote:
> Ka-Ping wrote:
> >     counter = Counter()
> >     readonly_facet = facet(counter, ['value'])
> >
> > If i've done this correctly, it should be impossible to alter the
> > contents of the list or the counter, given only the immutable_facet
> > or the readonly_facet, after restrict() has been called.
>
> I'm probably missing something, but a straightforward reflection
> approach seems to work on my machine:

That's funny.  After i called restrict() Python didn't let me get im_self.

    >>> restrict()
    >>> readonly_facet.value
    <bound method Counter.value of <__main__.Counter instance at 0x41df0>>
    >>> readonly_facet.value.im_self
    Traceback (most recent call last):
      File "<stdin>", line 1, in ?
    RuntimeError: restricted attribute
    >>>

It doesn't matter if i make the facet before or after restrict().

    >>> restrict()
    >>> rf2 = facet(counter, ['value'])
    >>> rf2.value
    <bound method Counter.value of <__main__.Counter instance at 0x41df0>>
    >>> rf2.value.im_self
    Traceback (most recent call last):
      File "<stdin>", line 1, in ?
    RuntimeError: restricted attribute
    >>>

I'm using

    Python 2.3 (#1, Sep 13 2003, 00:49:11)
    [GCC 3.3 20030304 (Apple Computer, Inc. build 1495)] on darwin


-- ?!ng