[issue42889] Incorrect behavior of Python parser after ast node of test program being modified

[Guido van Rossum]

Guido van Rossum  added the comment:

Yeah, there's supposed to be a checker.

--
nosy: +lys.nikolaou, serhiy.storchaka

___
Python tracker 

___
___
Python-bugs-list mailing list
Unsubscribe: 
https://mail.python.org/mailman/options/python-bugs-list/archive%40mail-archive.com

[issue42889] Incorrect behavior of Python parser after ast node of test program being modified

[Xinmeng Xia]

Xinmeng Xia  added the comment:

Nice suggestion! I change the argument and I can' find segfault program in 
transforming ast.Name.  But I do find a segfault program in transforming 
ast.BinOp!

Seeing the following example, this program will cause a segmentation fault on 
Python 3.10. No error will be reported during tranforming of node, but Python 
crashes during compiling the modified AST.


import ast
class RewriteName(ast.NodeTransformer):
def visit_BinOp(self, node):
if node.left.value == 1:
node.left = node
return node

code = """
mystr  = 1 + (2+3)
"""

myast = ast.parse(code)

transformer = RewriteName()
newast = transformer.visit(myast)

c = compile(newast,'','exec')
exec(c)
===

I really think we should add a checker before compiling modified ast node or 
cancel the function of compiling AST object. An illegal AST of a program should 
not throw into "compile" function directly.

--
type: behavior -> crash

___
Python tracker 

___
___
Python-bugs-list mailing list
Unsubscribe: 
https://mail.python.org/mailman/options/python-bugs-list/archive%40mail-archive.com

[issue42889] Incorrect behavior of Python parser after ast node of test program being modified

[Guido van Rossum]

Guido van Rossum  added the comment:

Hm, if your argument is just that you can make invalid identifiers this way, I 
still don't see why that's a big deal. You can do `x.__dict__["1"] = 1` and now 
you've given x an attribute that's not a valid identifier. You could also call 
the code object constructor directly with some valid identifiers. You have to 
do better than saying "it's dangerous". Can you demonstrate a segfault?

--

___
Python tracker 

___
___
Python-bugs-list mailing list
Unsubscribe: 
https://mail.python.org/mailman/options/python-bugs-list/archive%40mail-archive.com

[issue42889] Incorrect behavior of Python parser after ast node of test program being modified

[Xinmeng Xia]

Xinmeng Xia  added the comment:

Sorry, my description is a little confusing. My points lie on function 
'compile' and 'exec'. Yes, I agree. AST can be modified and don't correspond to 
valid programs.  But I don't think this invaild program can be compiled and 
exec without any check. It's dangerous.  

See the following program: For "compile" and "exec", no error is reported on 
Python 3.5-3.8 while error messages are reported on Python 3.9 and 3.10

==
import ast
class RewriteName(ast.NodeTransformer):
def visit_Name(self, node):
if node.id != "print":
node.id = str(False)
print(type(node.id))
return node

code = "a = 2;print(a)"

myast = ast.parse(code)
transformer = RewriteName()
newast = transformer.visit(myast)

c = compile(newast,'','exec')
exec(c)
=
Error message on Python 3.9  and 3.10.
-


Traceback (most recent call last):
  File "/home/xxm/Desktop/nameChanging/report/test1.py", line 574, in 
c = compile(newast,'','exec')
ValueError: Name node can't be used with 'False' constant
-

In fact, in class RewriteName, when "node.id" is assigned, the parser will 
check whether the identifier is a "str". If not,"TypeError: AST identifier must 
be of type str" will be reported. However, it's not enough. In Python, 
identifier names have their own naming rules.  "str" could be "+","1","False", 
but these are not legally id. So the above error could be reported.

--

___
Python tracker 

___
___
Python-bugs-list mailing list
Unsubscribe: 
https://mail.python.org/mailman/options/python-bugs-list/archive%40mail-archive.com

[issue42889] Incorrect behavior of Python parser after ast node of test program being modified

[Guido van Rossum]

Guido van Rossum  added the comment:

I don't think this is a bug, unless you can show an example where the bytecode 
compiler or the interpreter actually crashes. Basically you can change AST 
nodes in lots of ways that don't correspond to valid programs, and as long as 
you can't make CPython crash we don't care.

--
nosy: +gvanrossum

___
Python tracker 

___
___
Python-bugs-list mailing list
Unsubscribe: 
https://mail.python.org/mailman/options/python-bugs-list/archive%40mail-archive.com

[issue42889] Incorrect behavior of Python parser after ast node of test program being modified

[Xinmeng Xia]

New submission from Xinmeng Xia :

The following program will lead to a incorrect behavior of Python parser.  We 
change all variable to integer( forcely transformed to string) via 
ast.NodeTransformer. Then we compile the new code and execute it. It's 
surprising that code like "1=2; print(1)" can be compiled without error 
message. And more surprisingly, the execution result of "print(1)" is 2 ! !


import ast
class RewriteName(ast.NodeTransformer):
def visit_Name(self, node):
if node.id != "print":
node.id = str(node.lineno)
return node


code = "a = 2;print(a)"


myast = ast.parse(code)
transformer = RewriteName()
newast = transformer.visit(myast)

# print(ast.dump(newast))

print("new code:","")
print(ast.unparse(newast))
print("")

c = compile(newast,'','exec')
exec(c)
=

output result:
new code: 
1 = 2
print(1)

2

Expected result: (1). Syntax error during compilation. "1" should not be the 
correct identifier of program, even if it's forcely transformed to string. (2). 
The output of execution should be "1"  , since the parameter of "print()" in 
the new code is string "1".  

This incorrect behaviors exists on all version of Python(from Python2 to Python 
3).

--
components: Interpreter Core
messages: 384799
nosy: xxm
priority: normal
severity: normal
status: open
title: Incorrect behavior of Python parser after ast node of test program  
being modified
type: behavior
versions: Python 3.10, Python 3.6, Python 3.7, Python 3.8, Python 3.9

___
Python tracker 

___
___
Python-bugs-list mailing list
Unsubscribe: 
https://mail.python.org/mailman/options/python-bugs-list/archive%40mail-archive.com