[Python-Dev] Re: It is really necessary to check that a object has a Py_TPFLAGS_HEAPTYPE flag?

2021-02-10 Thread Jim J. Jewett
The last time I noticed this question (probably around python 2.4?), it was 
considered a deliberate decision.

There are languages with more open classes, such as (IIRC) Ruby and Smalltalk, 
but Python chose to remain somewhat closed, because monkey-patching is 
undesirable, and can be a problem for security audits.

Whether it would really open additional attack vectors or crash possibilities 
... wasn't judged worth the time to analyze or the risk of being wrong.  Maybe 
those tradeoffs have changed, but if you don't get any other answers, that (and 
the bias for status quo) is the likely explanation.

-jJ
___
Python-Dev mailing list -- python-dev@python.org
To unsubscribe send an email to python-dev-le...@python.org
https://mail.python.org/mailman3/lists/python-dev.python.org/
Message archived at 
https://mail.python.org/archives/list/python-dev@python.org/message/H3TLXXUEFZMKD4A7RBGUSILSQ6TSMCOI/
Code of Conduct: http://python.org/psf/codeofconduct/


[Python-Dev] Re: It is really necessary to check that a object has a Py_TPFLAGS_HEAPTYPE flag?

2021-02-15 Thread Victor Stinner
On Tue, Feb 9, 2021 at 4:53 AM Kazantcev Andrey  wrote:
> I decided to figure out why it is impossible to change methods of built-in 
> types and found
> ```
> if (!(type->tp_flags & Py_TPFLAGS_HEAPTYPE)) {
> PyErr_Format(
> PyExc_TypeError,
> "can't set attributes of built-in/extension type '%s'",
> type->tp_name);
> return -1;
> }
> ```
> in function type_setattro.
> If comment this line and try to patch method __eq__ on the list for example 
> the code will work as expected

I removed this "if" and tested:

$ ./python
Python 3.10.0a5+ (heads/master-dirty:ab2d481639, Feb 16 2021, 00:55:58)
>>> "a" == "b"
False
>>> str.__eq__=lambda x,y: True
>>> "a" == "b"
True

It seems technically possible to override attributes/methods of
built-in types, but the question is more if it's desirable?

IMO it goes against the specification of the Python language itself.
For example, in Python, it's not allowed to add methods to built-in
types. Example (with the removed "if")

>>> str.strip_spaces=lambda s: s.strip(" \t")
>>> " a ".strip_spaces()
'a'

The problem is that built-in types are shared by everything, and
adding non-standard methods means that code using it becomes
non-standard (cannot be used on an "unmodified" Python). Do you want
to see projects popping up on PyPI which rely on a special
(non-standard) str methods like strip_spaces()?

I didn't use Ruby on Rails, but the feedback that I heard is that the
ability to extend built-in types is appealing, but it is problematic
in practice.

Victor
-- 
Night gathers, and now my watch begins. It shall not end until my death.
___
Python-Dev mailing list -- python-dev@python.org
To unsubscribe send an email to python-dev-le...@python.org
https://mail.python.org/mailman3/lists/python-dev.python.org/
Message archived at 
https://mail.python.org/archives/list/python-dev@python.org/message/WOEGG2G5PKIXFVB5YOF7MI6OPNTCYQCZ/
Code of Conduct: http://python.org/psf/codeofconduct/


[Python-Dev] Re: It is really necessary to check that a object has a Py_TPFLAGS_HEAPTYPE flag?

2021-02-15 Thread Emily Bowman
On Mon, Feb 15, 2021 at 4:11 PM Victor Stinner  wrote:

>
> I didn't use Ruby on Rails, but the feedback that I heard is that the
> ability to extend built-in types is appealing, but it is problematic
> in practice.
>

Monkeypatching's such a part of the Ruby (and Javascript) culture that
there isn't much pushback over it. The biggest problem is that it's such a
part of the culture that it's not uncommon to have multiple modules
redefining the same name in incompatible ways, which is as painful to track
down as it sounds. Ruby also has refinements, which only modify within a
specific scope (up to a single file), so forgetting whether it's enabled
can get you even inside the same project.

-Em
___
Python-Dev mailing list -- python-dev@python.org
To unsubscribe send an email to python-dev-le...@python.org
https://mail.python.org/mailman3/lists/python-dev.python.org/
Message archived at 
https://mail.python.org/archives/list/python-dev@python.org/message/RWDD7ENAIUQKO62ISDMSG53I7AD5DNLD/
Code of Conduct: http://python.org/psf/codeofconduct/


[Python-Dev] Re: It is really necessary to check that a object has a Py_TPFLAGS_HEAPTYPE flag?

2021-02-16 Thread Андрей Казанцев
It seems technically possible to override attributes/methods of built-in types, but the question is more if it's desirable? The problem is that you cannot override the method not only in built-in types but also, for example, in `lxml.etree` classes. I wrote a module that changes the `type_setattro` method to mine, which does not have this check. And I'm wondering if there are any problems in this solution (in addition to philosophical ones) or everything will work as it should (and not as inheritance from built-in types). Thank you for participating in the discussion.___
Python-Dev mailing list -- python-dev@python.org
To unsubscribe send an email to python-dev-le...@python.org
https://mail.python.org/mailman3/lists/python-dev.python.org/
Message archived at 
https://mail.python.org/archives/list/python-dev@python.org/message/5GBZLFJ5JFIW336LRH7TX6OKPA47LOG5/
Code of Conduct: http://python.org/psf/codeofconduct/


[Python-Dev] Re: It is really necessary to check that a object has a Py_TPFLAGS_HEAPTYPE flag?

2021-02-16 Thread Kazantcev Andrey
Victor Stinner wrote:
> It seems technically possible to override attributes/methods of built-in 
> types, but the question is more if it's desirable?

The problem is that you cannot override the method not only in built-in types 
but also, for example, in `lxml.etree` classes. I wrote a module that changes 
the `type_setattro` method to mine, which does not have this check. And I'm 
wondering if there are any problems in this solution (in addition to 
philosophical ones) or everything will work as it should (and not as an 
inheritance from built-in types).
 
Thank you for participating in the discussion.
___
Python-Dev mailing list -- python-dev@python.org
To unsubscribe send an email to python-dev-le...@python.org
https://mail.python.org/mailman3/lists/python-dev.python.org/
Message archived at 
https://mail.python.org/archives/list/python-dev@python.org/message/OK47U3SRICVUIDC6V6KR3UMXKPOEVA3L/
Code of Conduct: http://python.org/psf/codeofconduct/


[Python-Dev] Re: It is really necessary to check that a object has a Py_TPFLAGS_HEAPTYPE flag?

2021-02-16 Thread Petr Viktorin

On 2/16/21 11:50 AM, Андрей Казанцев wrote:

It seems technically possible to override attributes/methods of
built-in types, but the question is more if it's desirable?

The problem is that you cannot override the method not only in built-in 
types but also, for example, in `lxml.etree` classes. I wrote a module 
that changes the `type_setattro` method to mine, which does not have 
this check. And I'm wondering if there are any problems in this solution 
(in addition to philosophical ones) or everything will work as it should 
(and not as inheritance from built-in types).

Thank you for participating in the discussion.



As with built-in types, lxml.etree classes and all other static (i.e. 
non-heap) types are shared between all interpreters in a process. 
Changing them has the same issues as with built-in types.

The check for the Py_TPFLAGS_HEAPTYPE flag is correct.
___
Python-Dev mailing list -- python-dev@python.org
To unsubscribe send an email to python-dev-le...@python.org
https://mail.python.org/mailman3/lists/python-dev.python.org/
Message archived at 
https://mail.python.org/archives/list/python-dev@python.org/message/VITJX3QT2YG3AN5CY4FB7OP2VLSSP4UZ/
Code of Conduct: http://python.org/psf/codeofconduct/