Another potential avenue for attacks: I can access the various class and metaclass objects easily:
>>> f = FileReader('/etc/passwd') >>> f.__class__ <class 'safelite.NamespaceObject'> >>> f.__class__.__metaclass__ <class 'safelite.NamespaceContext'> >>> f.__class__.__metaclass__.__call__ <unbound method NamespaceContext.__call__> >>> f.__class__.__metaclass__.__call__.im_func <function __call__ at 0x66470> >>> kall = f.__class__.__metaclass__.__call__.im_func >>> Now calling kall() with appropriate arguments will allow me to let the supervisor do setattr() operations on any object I have access to. It will probably end with an exception but that shouldn't matter: >>> kall(f.__class__.__metaclass__, [('foo', 47)]) <type 'list'> >>> f.__class__.__metaclass__.foo 47 >>> Insofar as the metaclass has any purpose at all for security this might let us thwart that purpose... -- --Guido van Rossum (home page: http://www.python.org/~guido/) _______________________________________________ Python-Dev mailing list Python-Dev@python.org http://mail.python.org/mailman/listinfo/python-dev Unsubscribe: http://mail.python.org/mailman/options/python-dev/archive%40mail-archive.com