[Python-Dev] Challenge: Please break this! [Now with blog post]

[Guido van Rossum]

Another potential avenue for attacks:

I can access the various class and metaclass objects easily:

>>> f = FileReader('/etc/passwd')
>>> f.__class__
<class 'safelite.NamespaceObject'>
>>> f.__class__.__metaclass__
<class 'safelite.NamespaceContext'>
>>> f.__class__.__metaclass__.__call__
<unbound method NamespaceContext.__call__>
>>> f.__class__.__metaclass__.__call__.im_func
<function __call__ at 0x66470>
>>> kall = f.__class__.__metaclass__.__call__.im_func
>>>

Now calling kall() with appropriate arguments will allow me to let the
supervisor do setattr() operations on any object I have access to. It
will probably end with an exception but that shouldn't matter:

>>> kall(f.__class__.__metaclass__, [('foo', 47)])
<type 'list'>
>>> f.__class__.__metaclass__.foo
47
>>>

Insofar as the metaclass has any purpose at all for security this
might let us thwart that purpose...

-- 
--Guido van Rossum (home page: http://www.python.org/~guido/)